vercel

Pass

Audited by Gen Agent Trust Hub on Oct 24, 2026

Risk Level: SAFE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze build logs, deployment details, and runtime error messages. This represents a potential ingestion surface for untrusted data if an attacker can influence the content of build logs (e.g., through a malicious pull request).
  • Ingestion points: Analysis of deployment build logs and error messages in SKILL.md and gemini.md.
  • Boundary markers: No explicit markers are used to delimit untrusted log data from the agent's instructions.
  • Capability inventory: The skill recommends standard CLI operations such as vercel build, vercel env pull, and npm install.
  • Sanitization: Not explicitly implemented; however, the skill focuses on providing manual diagnostic guidance to the user.
  • [EXTERNAL_DOWNLOADS]: The skill recommends the installation of the official Vercel CLI from the public npm registry. This is a standard and expected dependency for the platform's deployment workflow.
  • [COMMAND_EXECUTION]: Provides instructions for using standard Vercel CLI tools (vercel login, vercel link, vercel env pull, vercel build). These commands are essential for the primary purpose of managing project deployments and are documented according to official vendor practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 24, 2026, 04:36 AM