skills/arthjean/skills/vercel-cli/Gen Agent Trust Hub

vercel-cli

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses the bunx package runner to execute the vercel CLI and the ctx7 documentation tool from the npm registry. The Vercel CLI is an official tool from a well-known service.
  • [COMMAND_EXECUTION]: Several Bash scripts automate interactions with Vercel's infrastructure. These scripts securely handle the VERCEL_TOKEN by using temporary file descriptors (3<<<) during curl calls, which prevents the secret from appearing in process logs.
  • [INDIRECT_PROMPT_INJECTION]: The skill reads external data that could contain malicious instructions.
  • Ingestion points: Deployment logs in scripts/vercel-logs.sh and external content fetched via scripts/vercel-bypass.sh.
  • Boundary markers: There are no technical delimiters or instructions to ignore embedded commands in the processed data.
  • Capability inventory: Includes execution of remote packages via bunx, network access via curl, and file modifications via env pull or vercel link.
  • Sanitization: The skill uses jq to process JSON data and regular expressions to validate environment variable names in scripts/vercel-env.sh.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 08:55 PM