lov-deploy-to-vercel
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Downloads and installs the official
vercelCLI package from the npm registry if it is not found on the system. It also interacts with Cloudflare's official API for DNS management. - [COMMAND_EXECUTION]: Executes shell commands to detect project frameworks, perform deployments, and configure domain aliases. It utilizes
nodeandpython3for parsing package metadata and API responses, respectively. - [DATA_EXFILTRATION]: Transmits deployment metadata and utilizes the
CLOUDFLARE_API_KEYfrom the environment to manage DNS records via Cloudflare's official API (api.cloudflare.com). These network operations are intended for the skill's primary functionality and target a well-known service. - [PROMPT_INJECTION]: The skill ingests user-provided domain names which are interpolated into shell commands and API requests.
- Ingestion points: Data enters the workflow via the
<domain>argument inSKILL.md. - Boundary markers: None present; the skill assumes the provided string is a valid domain.
- Capability inventory: Includes shell command execution (
vercel), file writing (vercel.json), and network requests (curl). - Sanitization: Employs standard bash variable quoting but lacks specific escaping for the JSON payload sent to the Cloudflare API.
Audit Metadata