vercel-agent-vercel-cli-with-tokens

Pass

Audited by Gen Agent Trust Hub on Sep 2, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes various Vercel CLI commands (vercel deploy, vercel link, vercel env) to manage cloud resources. These are standard operations for the intended purpose of the skill.- [CREDENTIALS_SAFE]: The skill handles VERCEL_TOKEN and other sensitive environment variables. It explicitly implements a security best practice by instructing the agent to export the token as an environment variable rather than passing it via the --token flag, which prevents secrets from being logged in shell history or process listings.- [EXTERNAL_DOWNLOADS]: The skill installs the official Vercel CLI using npm install -g vercel. This is a download from a well-known, trusted service (NPM registry) for its official package.- [INDIRECT_PROMPT_INJECTION]: The skill reads from .env files to locate tokens. While this is an ingestion of untrusted data, the skill uses specific grep patterns and doesn't execute the content directly, reducing the risk of injection affecting the agent's logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 2, 2026, 12:52 PM
Security Audit — agent-trust-hub — vercel-agent-vercel-cli-with-tokens