vercel-cli-with-tokens
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill is designed to identify and extract
VERCEL_TOKENcredentials from environment variables and.envfiles. It explicitly recommends best practices by exporting these secrets to the environment rather than passing them as command-line flags to avoid exposure in process listings. - [EXTERNAL_DOWNLOADS]: The skill installs the
vercelCLI package via the official npm registry and clones repositories viagit. These operations target well-known services and are standard requirements for the skill's functionality. - [COMMAND_EXECUTION]: The skill executes multiple shell commands to inspect local configuration files (
grep,sed,cat), manage project state (vercel link), and perform deployments (vercel deploy). These commands are limited to the scope of project management. - [DATA_EXFILTRATION]: The skill facilitates the transmission of project source code and environment variable values to Vercel's official deployment platform. This behavior is the primary intended function of the skill.
Audit Metadata