iblai-vibe-ops-deploy
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to build and deploy applications, including
pnpm buildandnpx vercel deployas part of its primary deployment functionality. - [DATA_EXFILTRATION]: The skill synchronizes local environment variables from
.env.localto Vercel's infrastructure. While this involves sending project configuration to a remote server, it is directed to a well-known service provider as part of the intended deployment process. - [EXTERNAL_DOWNLOADS]: The skill uses
npxto download and execute the official Vercel CLI from a well-known service registry. - [PROMPT_INJECTION]: The skill processes project configuration files which could serve as a surface for indirect prompt injection if those files are controlled by an untrusted party.
- Ingestion points:
next.config,.env.local, andtauri.conf.json(referenced in SKILL.md and deploy-command.md). - Boundary markers: No explicit delimiters or instructions to ignore embedded content are used when reading these files.
- Capability inventory: Shell command execution (
pnpm,npx), file system modification (vercel.json,.env), and Vercel API network operations. - Sanitization: No specific sanitization or validation of the content of these configuration files is described before they influence agent behavior.
Audit Metadata