vercel-env-puller
Warn
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runto execute external CLI tools (vercel) and local Python scripts (scripts/refresh_env_manifest.py) for managing environment variable manifests. - [EXTERNAL_DOWNLOADS]: Fetches sensitive project configurations from Vercel's cloud infrastructure using the
vercel env pullcommand to populate the sandbox with required secrets. - [DATA_EXFILTRATION]: The skill handles highly sensitive production credentials, including API keys for Anthropic and Stripe, and database connection strings. While it implements defensive patterns such as ephemeral storage and log-stripping, the processing of these secrets in memory constitutes an inherent exposure surface.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external
.envfiles which could theoretically contain malicious content designed to influence the receiving agent. Evidence chain: (1) Ingestion point: Vercel-generated.envfiles viavercel env pull; (2) Capability inventory:subprocess.runand file system access inSKILL.md; (3) Boundary markers: Explicit isolation within the Sandcastle sandbox and use of non-overlapping environment rules; (4) Sanitization: Basic parsing logic with no explicit content validation of variable values.
Audit Metadata