vercel-cli
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's instructions and references are consistent with official documentation for the Vercel CLI. No malicious patterns, obfuscation, or unauthorized access attempts were identified.
- [PROMPT_INJECTION]: The skill includes a placeholder for user input ($ARGUMENTS) within boundary tags () in the command template. This defines the input surface for the agent. The use of tags is a standard mitigation technique to help the model distinguish between instructions and untrusted data.
- [DATA_EXFILTRATION]: The skill provides guidance on managing environment variables and correctly identifies that hardcoding tokens in CLI flags is a security risk, instead recommending the use of environment variables to prevent leakage in process listings.
- [EXTERNAL_DOWNLOADS]: Installation instructions point to the official 'vercel' package on the public npm registry, and all documentation links target verified 'vercel.com' domains.
- [COMMAND_EXECUTION]: The skill documents various administrative CLI commands, such as 'vercel api' for REST API interaction and 'vercel project rm' for project management. These are legitimate capabilities required for the skill's stated purpose.
Audit Metadata