The Agent Skills Directory

[DATA_EXFILTRATION]: The script scripts/deploy.sh archives the entire project directory (excluding .git and node_modules) and transmits the resulting tarball to a remote endpoint.
Evidence: RESPONSE=$(curl -s -X POST "$DEPLOY_ENDPOINT" -F "file=@$TARBALL" -F "framework=$FRAMEWORK") found in scripts/deploy.sh.
Impact: This operation exfiltrates all local project source files, which may contain sensitive logic, configuration files, or proprietary intellectual property, to the external URL https://claude-skills-deploy.vercel.com/api/deploy.
[COMMAND_EXECUTION]: The skill relies on the execution of Vercel CLI and shell commands to perform deployments, promotions, and rollbacks.
Evidence: SKILL.md and reference files list commands such as vercel deploy, vercel promote, and vercel alias set.
Risk: While these are standard for Vercel operations, the agent is granted broad execution privileges to manage project infrastructure.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to an external API endpoint that is not recognized as a well-known service or trusted organization.
Evidence: The variable DEPLOY_ENDPOINT="https://claude-skills-deploy.vercel.com/api/deploy" is used in a curl POST command in scripts/deploy.sh.
Impact: Sending project data to unverified external endpoints is a significant security risk.

vercel-deploy