The Agent Skills Directory

[METADATA_POISONING]: The skill's metadata identifies the author as 'vercel', which conflicts with the provided author context of 'bytedance'. This discrepancy is deceptive regarding the skill's actual origin.
[DATA_EXFILTRATION]: The deploy.sh script archives the entire contents of the target project directory and uploads the resulting tarball to a remote endpoint (https://claude-skills-deploy.vercel.com/api/deploy). While it explicitly excludes node_modules and .git, it does not filter for other sensitive files such as .env files, configuration secrets, or private keys that may reside in the project root, potentially exposing credentials to the remote service during the deployment process.
[COMMAND_EXECUTION]: The skill executes several shell-based operations, including reading project files for framework detection, creating directory archives, and performing file system modifications such as renaming HTML files in the user's project path.
[INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by processing untrusted local project files and returning the API response from the remote deployment service directly to the agent's context.
Ingestion points: The script reads and packages local files from the user-provided path and inspects package.json for framework detection.
Boundary markers: There are no explicit delimiters or instructions to the agent to ignore potentially malicious content within the processed files or the deployment response.
Capability inventory: The skill utilizes shell execution, file system modifications (mv), and network requests (curl).
Sanitization: No sanitization or validation is performed on the files being packaged or the JSON response received from the Vercel deployment API before it is presented to the agent.

vercel-deploy