deploy-to-vercel

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill intentionally uploads the user's project tarball to hard-coded external "claimable deploy" endpoints (for claude / codex) which results in deliberate exfiltration of project contents (and potentially embedded secrets) to third-party servers before the user claims the deployment.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The scripts POST project tarballs at runtime to external deploy endpoints (https://codex-deploy-skills.vercel.sh/api/deploy and https://claude-skills-deploy.vercel.com/api/deploy), which the skill relies on to perform the deploys and which execute remote build/deploy logic on uploaded code.