vercel-deploy
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: Executes various Vercel CLI commands, including
vercel deploy,vercel link, andvercel whoami, to manage project status and trigger deployment actions. - [COMMAND_EXECUTION]: Invokes a local bash script (
scripts/deploy.sh) to handle deployments in environments where the Vercel CLI is not authenticated or available. - [EXTERNAL_DOWNLOADS]: Installs the official
vercelpackage from the global NPM registry, which is a well-known service for Vercel's deployment tooling. - [DATA_EXFILTRATION]: The fallback deployment script packages project source code (excluding
.envand.gitdirectories) and uploads the archive to a Vercel-hosted endpoint (codex-deploy-skills.vercel.sh) to perform the deployment. This is the intended functional behavior for environments without CLI access.
Audit Metadata