vercel-deploy
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill interacts with an external deployment API at
https://codex-deploy-skills.vercel.sh/api/deployto upload project artifacts for hosting. It also performs status checks against generated preview URLs to confirm deployment success. - [COMMAND_EXECUTION]: The skill executes local system commands including the
vercelCLI and a provided bash script (scripts/deploy.sh) to package and transmit project files. It follows best practices by checking for existing installations before attempting execution. - [DATA_EXFILTRATION]: While the skill transmits project source code to Vercel, this is the primary intended function of a deployment tool. The included deployment script explicitly prevents the exfiltration of sensitive data by excluding
.envfiles,.gitmetadata, andnode_modulesfrom the upload package. - [SAFE]: The skill's architecture respects sandbox boundaries, only requesting escalated network permissions when necessary for deployment, and provides clear user-facing guidance for authorization and deployment management.
Audit Metadata