agent-vercel

SUSPICIOUS. The skill’s stated Vercel administration capabilities are internally coherent and its token-handling guidance is safer than typical docs, but it relies on a locally installed agent-vercel CLI whose provenance is not established in the skill and which receives Vercel credentials. Because an unverifiable external binary handles tokens and can make live platform changes, overall security risk is high despite otherwise plausible purpose and mostly proportional scope.