vercel-deploy
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- Project Data Transmission: The skill packages the contents of a specified local directory into a compressed archive and uploads it to a Vercel-hosted API endpoint (
https://codex-deploy-skills.vercel.sh/api/deploy). This behavior is consistent with the skill's stated purpose of providing claimable preview deployments. - Local File Access and Modification: The
scripts/deploy.shscript interacts with the local file system to detect project frameworks viapackage.jsonand prepares static HTML projects by renaming single HTML files toindex.html. These actions are scoped to the project directory provided by the user. - Deployment Packaging Considerations: The packaging logic explicitly excludes standard directories like
node_modulesand.gitto minimize upload size and prevent the exposure of version control metadata. However, it does not automatically filter other potentially sensitive files such as.envfiles or SSH keys that might reside in the project root. Users are encouraged to maintain proper secret management by not storing sensitive credentials within the project folders being deployed.
Audit Metadata