vercel-cli-with-tokens
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill guides the agent through using the Vercel CLI, Git, and NPM to perform deployment and project management tasks. All commands are standard and appropriate for the skill's stated purpose.
- [CREDENTIALS_UNSAFE]: The skill involves accessing the
VERCEL_TOKENfrom environment variables or local.envfiles. It explicitly warns against using the token as a command-line flag to prevent exposure in shell history and process listings, demonstrating a focus on security best practices for secret handling. - [EXTERNAL_DOWNLOADS]: The skill installs the Vercel CLI via NPM and clones repositories via Git. These actions target well-known services and trusted repositories consistent with the Vercel development ecosystem.
- [INDIRECT_PROMPT_INJECTION]: The skill processes project configuration files and clones remote repositories. While this constitutes a data ingestion surface (ingesting data from project files and git remotes), the operations are restricted to standard deployment workflows and are handled by the Vercel CLI, which does not escalate the risk profile.
Audit Metadata