The Agent Skills Directory

[DATA_EXFILTRATION]: The deployment script scripts/deploy.sh reads local project files and uploads them as a compressed tarball to an external endpoint (https://codex-deploy-skills.vercel.sh/api/deploy) for processing and deployment.
Evidence: tar -czf "$TARBALL" -C "$STAGING_DIR" . followed by curl -s -X POST "$DEPLOY_ENDPOINT" -F "file=@$TARBALL" -F "framework=$FRAMEWORK".
The script explicitly implements a security measure by excluding sensitive files such as .env, .env.*, and .git from the package to prevent accidental exposure of local secrets or configuration.
The target domain vercel.sh belongs to a well-known service provider.
[COMMAND_EXECUTION]: The skill relies on executing shell commands and scripts to perform its deployment tasks.
Evidence: Instructions call for vercel deploy and bash scripts/deploy.sh. The script uses system utilities including tar, curl, find, mv, and mktemp.
[INDIRECT_PROMPT_INJECTION]: The skill processes local files from the project directory to automate deployment configuration.
Ingestion points: scripts/deploy.sh reads package.json to detect frameworks and scans for .html files to identify static projects.
Boundary markers: None present for the content of the processed files.
Capability inventory: The skill has file system access (read/write/delete) and network access via curl.
Sanitization: The script sanitizes the upload package by excluding .env and .git files.

vercel-deploy