The Agent Skills Directory

[DATA_EXFILTRATION]: The fallback script scripts/deploy.sh archives the local project directory (excluding .git, node_modules, and .env files) into a tarball and uploads it via a POST request to https://codex-deploy-skills.vercel.sh/api/deploy. This constitutes a significant transfer of project source code to an external, non-standard service endpoint.
[COMMAND_EXECUTION]: The skill relies on the execution of shell commands and a local bash script (scripts/deploy.sh) to perform file system operations (staging, archiving) and network communication.
[PRIVILEGE_ESCALATION]: Instructions in SKILL.md explicitly direct the agent to request sandbox_permissions=require_escalated if network calls are blocked, which increases the attack surface by bypassing default sandbox network restrictions.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface by reading and parsing local package.json files and processing JSON responses from the external deployment server. The resulting URLs are returned to the user, creating a path for a potentially malicious server to inject deceptive links or instructions into the agent's output.
[EXTERNAL_DOWNLOADS]: The skill uses curl to send data to an external API and subsequently performs polling requests to the generated preview URL to check deployment status, despite instructions in SKILL.md advising against fetching the deployed URL.

vercel-deploy