deploy-to-vercel

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The two deploy endpoints and the preview vercel.app subdomain are user-controlled deployment endpoints that accept uploaded site archives and serve arbitrary content, so they can be used to host or distribute malicious payloads or to exfiltrate sensitive files if misused.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The included helper scripts intentionally package and upload the user's project archive to third‑party "claimable deploy" endpoints, which can exfiltrate source code, configs, and secrets to external servers outside the user's account/control.