update-shop
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- External Resource Access: The skill fetches template updates and versioning information from the official vercel/shop repository on GitHub. This is used to synchronize the local project with the latest recommended template changes.
- Local File Management: It reads and writes to project-specific configuration files, such as .vercel-shop/rollout-state.json, to track update progress and record user decisions. This helps ensure that updates are handled consistently across different sessions.
- Indirect Prompt Injection Surface: The skill processes external markdown files from the rollout log to determine necessary code changes. While this provides a way for external content to guide agent actions, the process is structured to include user confirmation before any modifications are applied to the codebase.
Audit Metadata