vercel-preview-cleanup
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses GitHub Actions and shell scripts to automate Vercel deployment management. It interacts exclusively with well-known services (Vercel API and GitHub API).
- [COMMAND_EXECUTION]: The shell scripts and workflows use
curl,ghCLI, andjqfor data processing. All user-controlled inputs (such as branch names) are properly escaped or handled via structured data parsing to prevent injection. - Evidence: In
templates/reusable-vercel-preview-cleanup.yml, branch names are escaped before use in GitHub API calls:enc_branch="$(printf '%s' "$BRANCH" | sed 's/%/%25/g; s/#/%23/g')". - [CREDENTIALS_UNSAFE]: No hardcoded credentials were found. The skill correctly instructs users to use GitHub Secrets for sensitive tokens and repository variables for configuration.
- [PROMPT_INJECTION]: No prompt injection attempts or bypass instructions were detected in the skill's instructions.
- [EXTERNAL_DOWNLOADS]: The skill does not download or execute code from untrusted external sources. The GitHub Actions workflows are designed to be hosted within the user's own organization and the caller template encourages pinning to a full commit SHA for integrity.
Audit Metadata