vercel-deploy

Pass

Audited by Gen Agent Trust Hub on Aug 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses curl to transmit data to https://claude-skills-deploy.vercel.com/api/deploy. This endpoint is managed by a well-known service and is used for the skill's primary purpose of deployment.
  • [COMMAND_EXECUTION]: Executes shell commands including tar to package project files, find to locate HTML files, and curl to perform network requests. These operations are restricted to the provided project path.
  • [DATA_EXFILTRATION]: The script packages the project directory into a tarball and uploads it to an external server. While the destination is a well-known and trusted service, the script's exclusion logic only covers .git and node_modules. Any other files in the project root, including potentially sensitive environment variables (.env, .env.local) or configuration secrets, would be included in the upload if present.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 13, 2026, 03:54 PM
Security Audit — agent-trust-hub — vercel-deploy