vercel-deploy

Pass

Audited by Gen Agent Trust Hub on Sep 7, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the vercel CLI globally using the npm package manager. Vercel is a well-known and established platform for frontend deployment and hosting.
  • [COMMAND_EXECUTION]: The skill uses various shell commands, including npm for installation and the vercel CLI for logging in, deploying to production, managing secrets, and inspecting logs. These commands are directly related to the skill's primary function of managing Vercel deployments.
  • [INDIRECT_PROMPT_INJECTION]: The skill involves the ingestion and analysis of build logs, which creates a potential surface for indirect prompt injection if the logs contain untrusted content generated during the build process.
    1. Ingestion points: The agent is instructed to read build logs via vercel logs or from user-provided input in SKILL.md.
    1. Boundary markers: There are no explicit delimiters or instructions to ignore potential commands embedded within the logs.
    1. Capability inventory: The skill environment allows for shell command execution through the npm and vercel binaries.
    1. Sanitization: The skill does not implement sanitization or validation of the log data before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 7, 2026, 01:38 PM
Security Audit — agent-trust-hub — vercel-deploy