marketplace

Pass

Audited by Gen Agent Trust Hub on Mar 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [Command Execution]: The skill provides instructions for using the vercel CLI to manage integrations, verify project links, and synchronize environment variables. These commands are standard for the platform's development workflow.- [External Downloads]: The skill references npx commands to scaffold new integration projects and Next.js applications using official templates. These operations involve fetching code from standard registries to initialize local development environments.- [Indirect Prompt Injection Surface]: The documentation includes patterns for building integrations that receive and process external data via lifecycle webhooks.
  • Ingestion points: Untrusted data enters the application context via JSON payloads in webhook handlers, specifically in app/api/webhook/route.ts.
  • Boundary markers: The example implementation incorporates signature verification to authenticate the origin of the data.
  • Capability inventory: The integration examples demonstrate capabilities for provisioning database resources and managing project-level environment variables through the Vercel API.
  • Sanitization: The skill mitigates risks by explicitly instructing developers to use verifyVercelSignature to ensure that processed payloads originate from a verified source before executing downstream operations.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 25, 2026, 01:39 PM