deploy-to-vercel
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Installs the official Vercel CLI from the public npm registry (
npm install -g vercel) if it is not already available in the execution environment. - [COMMAND_EXECUTION]: Executes shell commands including
git,vercelCLI, and local bash scripts (resources/deploy.shandresources/deploy-codex.sh) to manage the deployment lifecycle. - [DATA_EXFILTRATION]: Transfers project source code to Vercel's official deployment endpoints (
claude-skills-deploy.vercel.comandcodex-deploy-skills.vercel.sh). This is the intended primary purpose of the skill and utilizes well-known, trusted service domains. - [SAFE]: The deployment scripts incorporate explicit security measures by excluding sensitive directories and files, such as
.git,node_modules, and.envenvironment files, from the uploaded project archive.
Audit Metadata