vercel-deploy

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
  • Project Data Transmission: The skill packages the contents of a specified local directory into a compressed archive and uploads it to a Vercel-hosted API endpoint (https://codex-deploy-skills.vercel.sh/api/deploy). This behavior is consistent with the skill's stated purpose of providing claimable preview deployments.
  • Local File Access and Modification: The scripts/deploy.sh script interacts with the local file system to detect project frameworks via package.json and prepares static HTML projects by renaming single HTML files to index.html. These actions are scoped to the project directory provided by the user.
  • Deployment Packaging Considerations: The packaging logic explicitly excludes standard directories like node_modules and .git to minimize upload size and prevent the exposure of version control metadata. However, it does not automatically filter other potentially sensitive files such as .env files or SSH keys that might reside in the project root. Users are encouraged to maintain proper secret management by not storing sensitive credentials within the project folders being deployed.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 09:12 AM
Security Audit — agent-trust-hub — vercel-deploy