The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses various system commands including git (for status, commit, and push) and the vercel CLI (for authentication, linking projects, and triggering deployments).
[EXTERNAL_DOWNLOADS]: The skill provides instructions to install the vercel CLI globally via npm install -g vercel. This is a standard installation of a tool from a well-known service provider.
[INDIRECT_PROMPT_INJECTION]: The skill processes local project files such as package.json and root directory contents to identify frameworks and package applications. While this presents an attack surface where a malicious project could influence agent behavior, the risk is minimal as the scripts focus on packaging and uploading files rather than prompt interpolation. The impact is further mitigated by the script's logic to exclude .env files and sensitive directories.
[DATA_EXFILTRATION]: The skill uploads project source code to Vercel-owned endpoints (claude-skills-deploy.vercel.com and codex-deploy-skills.vercel.sh). This is the primary intended function of the skill and uses official vendor infrastructure. The scripts proactively protect user data by using --exclude flags for sensitive files like .env, .env.*, and .git during the packaging process.

deploy-to-vercel