skills/vercel/vercel-plugin/queues/Gen Agent Trust Hub

queues

Pass

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [Data Processing Surface]: The skill documents the processing of external messages via the handleCallback function (e.g., in app/api/queues/process-order/route.ts). Because these messages may contain data from untrusted sources, they represent a potential surface for indirect prompt injection.
  • Ingestion points: Messages enter the application flow through the handleCallback handler.
  • Boundary markers: The provided examples do not illustrate the use of specific delimiters or instructions to the agent to ignore potentially malicious embedded content within the JSON payload.
  • Capability inventory: The code is designed to run within Vercel Functions, which possess standard capabilities for network and filesystem access.
  • Sanitization: The skill does not explicitly demonstrate input sanitization, which is an important consideration for developers when processing message queue data.
  • [Official Package Management]: The instructions include commands to install official libraries such as @vercel/queue and vercel-queue. These references are to trusted vendor resources required for the skill's operation.
  • [Secure Development Practices]: The skill correctly advises using vercel link and vercel env pull for local development. This ensures that environment variables and authentication tokens are managed through the official platform CLI rather than being hardcoded or manually handled.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 17, 2026, 08:35 PM