The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes several bash commands to install tools and manage the local environment. These include rsync for file deployment, docker stop for container management, and pnpm for running dependency guard tests. These operations are restricted to the local host environment and are necessary for the skill's stated purpose of setting up a deployment infrastructure.
[CREDENTIALS_SAFE]: The skill uses onecli for secret management, which is a secure practice. It explicitly instructs the user to provide their own Vercel API token and stores it in the onecli secret store rather than hardcoding credentials or storing them in plain text. The credentials are automatically injected into the agent's environment via a proxy, minimizing direct exposure.
[PROMPT_INJECTION]: The SKILL.md contains strong instructions (HARD RULE) regarding agent behavior, such as delegating frontend work to a subagent. While these use authoritative language, they are internal design choices for task efficiency and do not attempt to bypass safety filters or exfiltrate data. The 'PI_CONCEALMENT' flag was evaluated and found to be a false positive; the instruction 'Do the work — don't tell the user to do it' refers to task automation and UX optimization, not hiding malicious activity from the user.

add-vercel