deploy-migration

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill fetches data from the Vercel API and GitHub API to determine deployment URLs and commit statuses.
  • Ingestion points: JSON output from vercel ls and GraphQL output from gh api as described in SKILL.md.
  • Boundary markers: None; the instructions use <url> and <merge-sha> placeholders for command interpolation without explicit delimiters.
  • Capability inventory: The agent executes npx vercel redeploy <url> and gh api graphql based on these external inputs.
  • Sanitization: No explicit sanitization or validation of the fetched URLs or SHAs is documented before their use in terminal commands.
  • [COMMAND_EXECUTION]: The skill utilizes the Vercel CLI (npx vercel@latest) and GitHub CLI (gh) to manage production deployments. These operations are consistent with the skill's stated purpose of coordinating database migrations and verifying deployment status. The commands target infrastructure associated with the author's specified projects.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 09:48 AM