vercel-optimize
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Vercel CLI (metrics, usage, api) to collect production signals. All CLI calls are made via execFile with arguments passed as arrays, which prevents shell injection vulnerabilities.
- [EXTERNAL_DOWNLOADS]: References are made to official documentation for Vercel, Next.js, and SvelteKit. These URLs are curated in a local documentation library and are used to ground recommendations in official guidance.
- [INDIRECT_PROMPT_INJECTION]: The skill audits user-provided source code, which serves as an ingestion point for untrusted data. This risk is well-mitigated by a multi-stage verification pipeline that mechanically validates all claims (counts, snippets, and citations) against the local filesystem and production signals before any recommendation is presented to the user.
- [SAFE]: The skill implements proactive security measures, such as a redaction utility that strips Vercel authentication tokens and project/team identifiers from logs and error messages to prevent accidental exposure.
Audit Metadata