deploy-migration
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches data from the Vercel API and GitHub API to determine deployment URLs and commit statuses.
- Ingestion points: JSON output from
vercel lsand GraphQL output fromgh apias described inSKILL.md. - Boundary markers: None; the instructions use
<url>and<merge-sha>placeholders for command interpolation without explicit delimiters. - Capability inventory: The agent executes
npx vercel redeploy <url>andgh api graphqlbased on these external inputs. - Sanitization: No explicit sanitization or validation of the fetched URLs or SHAs is documented before their use in terminal commands.
- [COMMAND_EXECUTION]: The skill utilizes the Vercel CLI (
npx vercel@latest) and GitHub CLI (gh) to manage production deployments. These operations are consistent with the skill's stated purpose of coordinating database migrations and verifying deployment status. The commands target infrastructure associated with the author's specified projects.
Audit Metadata