The Agent Skills Directory

[DATA_EXFILTRATION]: The deployment script packages the entire project directory using tar and uploads it to an external endpoint (claude-skills-deploy.vercel.com). The script lacks a comprehensive exclusion list for sensitive files, meaning environment variables (.env, .env.local), configuration secrets, or private keys present in the folder will be transmitted.- [COMMAND_EXECUTION]: The skill executes shell commands including tar, curl, find, and mv. It automatically renames local HTML files to index.html if a specific condition is met, which modifies the user's local file system without explicit confirmation.- [EXTERNAL_DOWNLOADS]: The skill performs network requests to an external deployment API. While the target domain is associated with a well-known service (Vercel), the unauthenticated upload of project content is a significant data handling concern.- [PROMPT_INJECTION]: The skill metadata contains deceptive information, falsely claiming the author is 'vercel' in the YAML frontmatter while the actual author is 'stophobia', which could mislead users regarding the skill's origin and safety.

vercel-deploy