vercel-agent-vercel-cli-with-tokens
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various Vercel CLI commands (
vercel deploy,vercel link,vercel env) to manage cloud resources. These are standard operations for the intended purpose of the skill.- [CREDENTIALS_SAFE]: The skill handlesVERCEL_TOKENand other sensitive environment variables. It explicitly implements a security best practice by instructing the agent to export the token as an environment variable rather than passing it via the--tokenflag, which prevents secrets from being logged in shell history or process listings.- [EXTERNAL_DOWNLOADS]: The skill installs the official Vercel CLI usingnpm install -g vercel. This is a download from a well-known, trusted service (NPM registry) for its official package.- [INDIRECT_PROMPT_INJECTION]: The skill reads from.envfiles to locate tokens. While this is an ingestion of untrusted data, the skill uses specificgreppatterns and doesn't execute the content directly, reducing the risk of injection affecting the agent's logic.
Audit Metadata