vercel-deployments
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the installation of the official
vercelCLI and utility packages (@vercel/speed-insights,@vercel/analytics) from the npm registry. These are well-known tools provided by Vercel for platform interaction. - [COMMAND_EXECUTION]: The documentation includes various Vercel CLI commands for managing project infrastructure, including deployment creation, domain management, and environment variable configuration.
- [INDIRECT_PROMPT_INJECTION]: The skill describes workflows that ingest untrusted external data, creating a surface for indirect prompt injection.
- Ingestion points: The
vercel logscommand retrieves deployment logs from remote servers into the agent's execution context. The GitHub Actions integration (preview.yml) uses deployment output variables to generate automated PR comments. - Boundary markers: None are present in the provided examples to delimit external log data from agent instructions.
- Capability inventory: The agent has the capability to execute shell commands (
vercel), modify environment variables, and interact with the GitHub API viagithub-script. - Sanitization: No sanitization or validation of log content or deployment outputs is implemented before the data is processed or posted to external platforms.
Audit Metadata