The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interpolates user-controlled inputs, such as DEPLOY_BRANCH, VERCEL_ORG_ID, and VERCEL_PROJECT_ID, directly into shell commands and double-quoted strings. In Bash, double-quoted strings and unquoted heredocs (e.g., <<EOF in Stage 02) perform command substitution, meaning inputs containing backticks or $(...) could result in arbitrary command execution within the agent's environment.
[COMMAND_EXECUTION]: The skill manages state across stages by writing variables to /tmp/vercel-deploy-ctx.env and using the source command to load them in later stages. Dynamically loading executable content or environment files from shared temporary directories is a risky pattern if the environment is not strictly isolated.
[EXTERNAL_DOWNLOADS]: The skill utilizes npx vercel to download and execute the Vercel CLI from the npm registry at runtime. It also performs multiple API requests to api.vercel.com to manage the deployment lifecycle. These interactions involve well-known service endpoints relevant to the skill's stated purpose.

vercel-deploy