marketplace-deploy

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • Standard Tool Installation: The skill includes instructions to install the Vercel CLI globally via npm. This is a routine operation for developers using the Vercel platform to manage and automate deployments from the command line.
  • Credential Configuration Workflow: The instructions guide the user through adding sensitive environment variables, including authentication secrets like AUTH0_SECRET, directly to the Vercel project environment. This aligns with secure practices by utilizing Vercel's managed secret storage rather than relying on local configuration for production values.
  • Configuration and Environment Verification: The skill prompts for the review of local files such as next.config.ts and .env.local to confirm that required headers and variables are present. These checks are designed to ensure that security controls, particularly frame-ancestors directives for iframe security, are correctly implemented before deployment.
  • Indirect Prompt Injection Surface: The skill processes information from local project files during the pre-deploy checklist. While these files are typically developer-controlled, they represent an entry point for data that influences the agent's verification process.
  • Ingestion points: Project files next.config.ts and .env.local are inspected for configuration values.
  • Boundary markers: The skill does not define specific boundary markers for the data read from configuration files.
  • Capability inventory: The skill utilizes shell capabilities to perform builds (npm run build), install packages (npm install), and execute deployment commands through the Vercel CLI.
  • Sanitization: The skill looks for specific string patterns (e.g., CSP header values) within configuration files to confirm their presence but does not perform broader sanitization of the file contents.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 10:11 AM