vercel-agent-deploy-to-vercel
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses various shell commands to interact with the environment, including
git,vercel, andtar. These are standard tools for deployment workflows and are used as intended for project state gathering and file packaging. - [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the official Vercel CLI via
npm install -g vercel. This is a standard installation procedure for a well-known service. - [DATA_EXFİLTRATION]: The deployment scripts (
deploy-codex.shanddeploy.sh) package project files and upload them to Vercel deployment endpoints (codex-deploy-skills.vercel.shandclaude-skills-deploy.vercel.com). This behavior is the primary purpose of the skill. Security is maintained by explicitly excluding sensitive paths like.env,.env.*, and.gitfrom the upload package usingtar --excludeflags. - [SAFE]: The skill is authored by 'theangrypit' (mirrored from Vercel Labs) and all external endpoints and tools mentioned (Vercel CLI, Vercel deployment APIs) are official vendor resources belonging to Vercel. No malicious obfuscation, persistence mechanisms, or privilege escalations were detected.
Audit Metadata