vercel-deploy

Pass

Audited by Gen Agent Trust Hub on Aug 19, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill makes a network request to an external deployment endpoint (claude-skills-deploy.vercel.com). This is consistent with the skill's stated purpose of providing an authenticated-less deployment flow for Vercel users.
  • [COMMAND_EXECUTION]: The script uses standard shell commands (tar, curl, grep, mktemp) to package the project directory and transmit it to the deployment endpoint. These operations are scoped to the project directory provided as an argument.
  • [DATA_EXPOSURE_&_EXFILTRATION]: While the skill uploads project source code to a remote server, it explicitly excludes sensitive directories like .git (which often contains credentials and history) and node_modules. The destination domain is a subdomain of Vercel, a well-known service, aligning with the skill's primary function.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 19, 2026, 02:14 PM
Security Audit — agent-trust-hub — vercel-deploy