nextjs-tremor-report
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill manages a local build environment in the
/tmpdirectory, executing system commands to initialize the project, install dependencies, and run build and deployment scripts. - [EXTERNAL_DOWNLOADS]: Fetches required software components including the Vercel CLI and standard web development libraries (Next.js, React, ECharts) from official package registries.
- [EXTERNAL_DOWNLOADS]: Connects to the Vercel API (
api.vercel.app) to retrieve project identifiers and account metadata necessary for the deployment process. - [DATA_EXFILTRATION]: Transmits the user-provided
VERCEL_API_TOKENto Vercel's official API endpoints for authentication. This transmission is a documented requirement for the skill's primary functionality and targets a well-known service. - [PROMPT_INJECTION]: The skill processes external data sources (markdown and JSON files containing market insights) to generate the final report content.
- Ingestion points: Reads analyst output files including
analysis/insights.md,analysis/swot_matrix.json, andanalysis/fact_check.md. - Boundary markers: The instructions do not specify explicit delimiters or warnings to ignore potentially malicious instructions embedded within the processed data files.
- Capability inventory: Possesses capabilities to perform network deployments and execute shell commands as part of the build pipeline.
- Sanitization: No explicit sanitization or validation logic is provided for the external data before it is rendered into the application components.
Audit Metadata