vercel-error
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection Surface: The skill processes external project code and HTTP error responses, which represent a potential entry point for untrusted instructions.
- Ingestion points: Project configuration files (package.json, lockfiles), source code, and HTTP error response bodies (references/http.md).
- Boundary markers: The skill incorporates 'Recovery authority' rules in references/contract-design.md that explicitly require user confirmation before acting on suggestions or links found within error text.
- Capability inventory: File system inspection (SKILL.md) and network communication for error reconstruction (references/http.md).
- Sanitization: Instructions mandate the redaction of sensitive debugging context (credentials, tokens, PII) and strictly separate internal diagnostics from client-safe public projections.
- Data Privacy Considerations: The guidance emphasizes the exclusion of secrets and sensitive metadata from publicly visible error fields, aligning with industry security recommendations for logging and error handling.
- Secure Error Reconstruction: The skill defines patterns for validating and parsing error data from remote sources, ensuring that upstream responses are verified for shape and content before being processed locally.
Audit Metadata