vercel-deploy
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes a network request to an external deployment endpoint (
claude-skills-deploy.vercel.com). This is consistent with the skill's stated purpose of providing an authenticated-less deployment flow for Vercel users. - [COMMAND_EXECUTION]: The script uses standard shell commands (
tar,curl,grep,mktemp) to package the project directory and transmit it to the deployment endpoint. These operations are scoped to the project directory provided as an argument. - [DATA_EXPOSURE_&_EXFILTRATION]: While the skill uploads project source code to a remote server, it explicitly excludes sensitive directories like
.git(which often contains credentials and history) andnode_modules. The destination domain is a subdomain of Vercel, a well-known service, aligning with the skill's primary function.
Audit Metadata