vercel-debug-bundle

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_CONTEXT_INJECTION]: The skill uses dynamic context injection placeholders in SKILL.md to display the current environment state when the skill is loaded. The commands !vercel --version and !node --version are benign version checks that facilitate troubleshooting without posing a security risk.
  • [DATA_EXFILTRATION]: The skill accesses sensitive local files and environment variables to build a debug bundle. This includes reading package.json, vercel.json, and the .env file. However, the implementation explicitly includes redaction logic, such as using sed to mask values in .env and only listing the names (not values) of environment variables via vercel env ls.
  • [EXTERNAL_DOWNLOADS]: The diagnostic scripts perform network operations using curl to interact with official Vercel services, including api.vercel.com for deployment metadata and www.vercel-status.com for platform health snapshots. These are well-known, trusted services relevant to the skill's primary function.
  • [COMMAND_EXECUTION]: The skill utilizes standard system tools such as tar for archiving, jq for JSON processing, and grep for log analysis. These tools are used within their intended scope for diagnostic data collection.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 03:47 AM