deploy-an-app
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands via Vercel CLI, Git, and OpenSSL to perform project management tasks and generate cryptographically secure secrets.
- [EXTERNAL_DOWNLOADS]: The skill downloads the Vercel CLI dynamically using npx and performs API requests to well-known service providers (Stripe, Resend, Inngest) for resource provisioning.
- [PROMPT_INJECTION]: The skill processes application source code and manifests, presenting an indirect prompt injection surface. 1. Ingestion points:
preflight.mdreadspackage.jsonand project files insrc/. 2. Boundary markers: Absent. 3. Capability inventory: Extensive shell execution, file system access, and network capabilities. 4. Sanitization: Project content is analyzed for configuration flags without explicit sanitization of embedded strings.
Audit Metadata