vercel-rate-limits
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides code templates for API handlers and middleware that ingest untrusted data from request headers like
x-forwarded-for. - Ingestion points: Identified in
SKILL.mdwithin the middleware and endpoint handler examples. - Boundary markers: None are implemented in the provided snippets.
- Capability inventory: The provided code is limited to returning HTTP status codes (200, 429) and does not interact with high-risk capabilities like the file system or shell execution.
- Sanitization: Untrusted header values are used directly as Map keys without validation or filtering.
- [EXTERNAL_DOWNLOADS]: The skill references and suggests the installation of official Vercel libraries and standard open-source utilities for implementation.
- Resources: Specifically recommends
@vercel/firewall,@vercel/functions,p-queue, anduuid.
Audit Metadata