vercel-deployments

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references the installation of the official vercel CLI and utility packages (@vercel/speed-insights, @vercel/analytics) from the npm registry. These are well-known tools provided by Vercel for platform interaction.
  • [COMMAND_EXECUTION]: The documentation includes various Vercel CLI commands for managing project infrastructure, including deployment creation, domain management, and environment variable configuration.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes workflows that ingest untrusted external data, creating a surface for indirect prompt injection.
  • Ingestion points: The vercel logs command retrieves deployment logs from remote servers into the agent's execution context. The GitHub Actions integration (preview.yml) uses deployment output variables to generate automated PR comments.
  • Boundary markers: None are present in the provided examples to delimit external log data from agent instructions.
  • Capability inventory: The agent has the capability to execute shell commands (vercel), modify environment variables, and interact with the GitHub API via github-script.
  • Sanitization: No sanitization or validation of log content or deployment outputs is implemented before the data is processed or posted to external platforms.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 05:44 PM
Security Audit — agent-trust-hub — vercel-deployments