marketplace
Pass
Audited by Gen Agent Trust Hub on Mar 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [Command Execution]: The skill provides instructions for using the
vercelCLI to manage integrations, verify project links, and synchronize environment variables. These commands are standard for the platform's development workflow.- [External Downloads]: The skill referencesnpxcommands to scaffold new integration projects and Next.js applications using official templates. These operations involve fetching code from standard registries to initialize local development environments.- [Indirect Prompt Injection Surface]: The documentation includes patterns for building integrations that receive and process external data via lifecycle webhooks. - Ingestion points: Untrusted data enters the application context via JSON payloads in webhook handlers, specifically in
app/api/webhook/route.ts. - Boundary markers: The example implementation incorporates signature verification to authenticate the origin of the data.
- Capability inventory: The integration examples demonstrate capabilities for provisioning database resources and managing project-level environment variables through the Vercel API.
- Sanitization: The skill mitigates risks by explicitly instructing developers to use
verifyVercelSignatureto ensure that processed payloads originate from a verified source before executing downstream operations.
Audit Metadata