deploy-to-vercel
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Installs the official Vercel CLI via npm install -g vercel.
- [DATA_EXFILTRATION]: Uploads project files to Vercel deployment endpoints (claude-skills-deploy.vercel.com and codex-deploy-skills.vercel.sh) as part of the intended deployment flow.
- [COMMAND_EXECUTION]: Uses git, vercel, tar, and curl to prepare and execute project deployments.
- [PROMPT_INJECTION]: Processes external project data (package.json) to detect frameworks, presenting a low risk of indirect prompt injection. 1. Ingestion points: package.json and project directory. 2. Boundary markers: None. 3. Capability inventory: curl, git, vercel, tar. 4. Sanitization: Excludes .env and .git files.
- [SAFE]: The skill incorporates safety measures to prevent the accidental upload of secrets and sensitive metadata.
Audit Metadata