deploy-to-vercel

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These URLs include claimable Vercel deploy endpoints and a preview subdomain that accept and host arbitrary uploaded projects (and can serve arbitrary files), so they can be used to distribute malicious content and should be treated as suspicious compared with official vendor download pages.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill intentionally uploads the user's project tarball to hard-coded external "claimable deploy" endpoints (for claude / codex) which results in deliberate exfiltration of project contents (and potentially embedded secrets) to third-party servers before the user claims the deployment.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The scripts POST project tarballs at runtime to external deploy endpoints (https://codex-deploy-skills.vercel.sh/api/deploy and https://claude-skills-deploy.vercel.com/api/deploy), which the skill relies on to perform the deploys and which execute remote build/deploy logic on uploaded code.