marketplace-deploy
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Standard Tool Installation: The skill includes instructions to install the Vercel CLI globally via
npm. This is a routine operation for developers using the Vercel platform to manage and automate deployments from the command line. - Credential Configuration Workflow: The instructions guide the user through adding sensitive environment variables, including authentication secrets like
AUTH0_SECRET, directly to the Vercel project environment. This aligns with secure practices by utilizing Vercel's managed secret storage rather than relying on local configuration for production values. - Configuration and Environment Verification: The skill prompts for the review of local files such as
next.config.tsand.env.localto confirm that required headers and variables are present. These checks are designed to ensure that security controls, particularlyframe-ancestorsdirectives for iframe security, are correctly implemented before deployment. - Indirect Prompt Injection Surface: The skill processes information from local project files during the pre-deploy checklist. While these files are typically developer-controlled, they represent an entry point for data that influences the agent's verification process.
- Ingestion points: Project files
next.config.tsand.env.localare inspected for configuration values. - Boundary markers: The skill does not define specific boundary markers for the data read from configuration files.
- Capability inventory: The skill utilizes shell capabilities to perform builds (
npm run build), install packages (npm install), and execute deployment commands through the Vercel CLI. - Sanitization: The skill looks for specific string patterns (e.g., CSP header values) within configuration files to confirm their presence but does not perform broader sanitization of the file contents.
Audit Metadata