The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external sources and possesses state-changing capabilities.
Ingestion points: The agent reads deployment logs (deployment logs), runtime logs (deployment runtime-logs), commit messages (deployment get), and environment variables (env get) which are sourced from external developers or codebases (SKILL.md, references/commands.md).
Boundary markers: The skill does not explicitly instruct the agent to use delimiters or ignore instructions embedded within the logs or commit messages.
Capability inventory: The skill allows the agent to perform high-impact actions including deployment promote, deployment rollback, env set, alias set, and raw api call operations (references/commands.md).
Sanitization: The underlying tool uses NDJSON for structured output and implements a --max-body-chars flag to truncate long log outputs, which provides some mitigation against very large injection payloads (references/output.md).
[COMMAND_EXECUTION]: The skill provides the agent with the ability to execute a wide range of shell commands via the agent-vercel CLI tool. This includes sensitive operations like env pull, which writes decrypted environment variables to a local .env file, and auth add, which modifies the system Keychain (SKILL.md, references/commands.md).

agent-vercel