The Agent Skills Directory

[COMMAND_EXECUTION]: The skill orchestrates a complex pipeline that involves running the Vercel CLI and various local Node.js utility scripts. These commands are executed using execFile to prevent shell injection vulnerabilities. Additionally, the library includes a redactSensitiveText utility that automatically removes Vercel tokens, project IDs, and organization IDs from diagnostic output and stderr before they can be surfaced to the user.
[INDIRECT_PROMPT_INJECTION]: The skill ingests production metrics and configuration data from Vercel APIs. It effectively mitigates the risk of indirect prompt injection by using deterministic threshold gates and strict JSON schemas. Its internal 'Doctrine' limits the agent's scope to specific files associated with verified performance issues, preventing the LLM from scanning the entire repository for potentially malicious payloads embedded in comments or documentation.
[SAFE]: The skill demonstrates a strong security posture by enforcing 'Rule 1: Observability before investigation.' It never reads source code until production signals justify an audit. Furthermore, it uses an allow-listed, version-aware citation library to ensure that all recommendations are grounded in official documentation and match the user's framework version, eliminating risk from fabricated or malicious URLs.

vercel-optimize