vercel-deploy
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled shell script
scripts/deploy.shto process deployment logic. The user-providedpathargument is passed directly to the shell, which could be an injection vector if the script does not perform sanitization. - [EXTERNAL_DOWNLOADS]: The skill references and interacts with Vercel, which is a well-known and trusted cloud service provider, for deploying web applications.
- [DATA_EXFILTRATION]: Project files are packaged and uploaded to a remote deployment service. The skill mitigates risks by explicitly excluding
.envand.gitdirectories from the upload package.
Audit Metadata