vercel-kv

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references the official @vercel/kv package and provides links to Vercel's official documentation and the Redis command reference. These are trusted, well-known resources for the intended development purpose.
  • [COMMAND_EXECUTION]: Instructions include standard development commands such as npm install @vercel/kv and vercel env pull, which are necessary for the setup and configuration of the storage service.
  • [DATA_EXPOSURE]: The skill correctly advises users to manage sensitive credentials (KV_REST_API_URL and KV_REST_API_TOKEN) through environment variables and ensure .env.local is added to .gitignore. It implements secure session handling using HTTP-only cookies and cryptographically secure session IDs.
  • [INDIRECT_PROMPT_INJECTION]: While the skill defines patterns for ingesting data from an external KV store (which could contain untrusted data), it does not include any dangerous capabilities like eval() or arbitrary command execution that could be triggered by the ingested content. The provided templates focus on data serialization and standard application logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 06:54 AM
Security Audit — agent-trust-hub — vercel-kv