vercel-debug-bundle
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses dynamic context injection placeholders in
SKILL.mdto display the current environment state when the skill is loaded. The commands!vercel --versionand!node --versionare benign version checks that facilitate troubleshooting without posing a security risk. - [DATA_EXFILTRATION]: The skill accesses sensitive local files and environment variables to build a debug bundle. This includes reading
package.json,vercel.json, and the.envfile. However, the implementation explicitly includes redaction logic, such as usingsedto mask values in.envand only listing the names (not values) of environment variables viavercel env ls. - [EXTERNAL_DOWNLOADS]: The diagnostic scripts perform network operations using
curlto interact with official Vercel services, includingapi.vercel.comfor deployment metadata andwww.vercel-status.comfor platform health snapshots. These are well-known, trusted services relevant to the skill's primary function. - [COMMAND_EXECUTION]: The skill utilizes standard system tools such as
tarfor archiving,jqfor JSON processing, andgrepfor log analysis. These tools are used within their intended scope for diagnostic data collection.
Audit Metadata