deploy-to-vercel
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses various Vercel CLI commands (
vercel deploy,vercel link,vercel whoami,vercel teams list) and git commands (git push,git remote) to manage project state and trigger deployments. - [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the Vercel CLI via the official npm registry using
npm install -g vercelwhen the tool is not found locally. - [DATA_EXFILTRATION]: To enable deployment in sandboxed environments, the fallback scripts (
deploy.shanddeploy-codex.sh) package and upload the project source code to Vercel-owned endpoints:claude-skills-deploy.vercel.comandcodex-deploy-skills.vercel.sh. This behavior is the primary intended purpose of the skill. The scripts implement security controls by excluding known sensitive directories and files (.git,node_modules,.env, and.env.*) from the uploaded archive. Additionally,deploy.shincludes a safeguard that prevents execution if a.vercelignorefile is present, ensuring it doesn't bypass user-defined exclusion rules.
Audit Metadata