vercel-local-dev-loop
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates a development loop that processes external configuration data and executes local project code, creating a potential surface for indirect prompt injection if the remote project settings or local source files are compromised.
- Ingestion points: Environment variables are synchronized from the Vercel platform into local files using
vercel env pull(SKILL.md). - Boundary markers: The instructions do not include specific delimiters or validation steps for the content of the environment variables.
- Capability inventory: The skill utilizes the
Bashtool to run development servers and install dependencies, includingvercel dev,npm run dev, andnpm install(SKILL.md, references/implementation.md). - Sanitization: No explicit sanitization or filtering of the environment variable content is performed before it is used by the development tools.
- [DYNAMIC_EXECUTION]: The skill involves the execution of local project code and tests using tools such as
tsx watch,vitest, and framework-specific dev servers (SKILL.md, references/implementation.md). The development server emulation and hot-reloading mechanisms involve runtime execution of JavaScript and TypeScript files defined within the project structure. - [SAFE]: The skill incorporates security best practices by recommending that sensitive local environment variable files (e.g.,
.env.local,.env.development.local) be excluded from version control to prevent the exposure of secrets in the project history.
Audit Metadata