{"data":{"skill":{"slug":"vercel-labs-deploy-to-vercel","name":"deploy-to-vercel","icon":"📦","repo":"https://github.com/vercel-labs/agent-skills/tree/main/skills/deploy-to-vercel/","status":"approved","author":"vercel-labs","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"be79cd15-10ee-4b6d-aa10-b723a695af57","skill_id":"6c56433f-f32d-43a5-8796-eaa162a3a78a","version":3,"content_hash":"451539352c8e7c31e18df7ba27dc466e","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Static analysis found extensive shell, network, and filesystem activity. Review confirms these patterns are expected for a Vercel deployment skill, but the fallback scripts package project files and upload them to external deploy endpoints, so publication should include a clear warning. No prompt injection text or confirmed malicious intent was found.","remediation":[],"risk_factor_evidence":[{"factor":"scripts","evidence":[{"file":"resources/deploy.sh","line_end":9,"line_start":1},{"file":"resources/deploy-codex.sh","line_end":9,"line_start":1},{"file":"SKILL.md","line_end":167,"line_start":162},{"file":"SKILL.md","line_end":210,"line_start":191}]},{"factor":"network","evidence":[{"file":"resources/deploy.sh","line_end":9,"line_start":9},{"file":"resources/deploy.sh","line_end":239,"line_start":239},{"file":"resources/deploy.sh","line_end":266,"line_start":266},{"file":"resources/deploy-codex.sh","line_end":9,"line_start":9},{"file":"resources/deploy-codex.sh","line_end":239,"line_start":239},{"file":"resources/deploy-codex.sh","line_end":266,"line_start":266},{"file":"SKILL.md","line_end":260,"line_start":253},{"file":"SKILL.md","line_end":280,"line_start":279}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":30,"line_start":23},{"file":"SKILL.md","line_end":49,"line_start":45},{"file":"SKILL.md","line_end":185,"line_start":185},{"file":"SKILL.md","line_end":235,"line_start":233},{"file":"resources/deploy.sh","line_end":170,"line_start":168},{"file":"resources/deploy.sh","line_end":206,"line_start":201},{"file":"resources/deploy-codex.sh","line_end":170,"line_start":168},{"file":"resources/deploy-codex.sh","line_end":206,"line_start":201}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":30,"line_start":19},{"file":"SKILL.md","line_end":78,"line_start":65},{"file":"SKILL.md","line_end":100,"line_start":88},{"file":"SKILL.md","line_end":131,"line_start":117},{"file":"SKILL.md","line_end":146,"line_start":139},{"file":"SKILL.md","line_end":217,"line_start":195},{"file":"resources/deploy.sh","line_end":196,"line_start":193},{"file":"resources/deploy.sh","line_end":227,"line_start":201},{"file":"resources/deploy.sh","line_end":250,"line_start":239},{"file":"resources/deploy-codex.sh","line_end":196,"line_start":193},{"file":"resources/deploy-codex.sh","line_end":227,"line_start":201},{"file":"resources/deploy-codex.sh","line_end":250,"line_start":239}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Project Archive Upload to External Deployment Endpoint","locations":[{"file":"resources/deploy.sh","line_end":206,"line_start":201},{"file":"resources/deploy.sh","line_end":239,"line_start":227},{"file":"resources/deploy-codex.sh","line_end":206,"line_start":201},{"file":"resources/deploy-codex.sh","line_end":239,"line_start":227},{"file":"SKILL.md","line_end":185,"line_start":162},{"file":"SKILL.md","line_end":221,"line_start":191}],"confidence":0.88,"description":"The fallback scripts stage the selected project, create an archive, and upload it with curl to Vercel-hosted deployment endpoints. This is expected for deployment, but it can disclose project files if a user points the script at the wrong directory or stores secrets outside excluded environment files.","confidence_reasoning":"The scripts clearly tar project files and POST the archive to fixed deployment endpoints. The behavior matches the skill purpose, so the concern is disclosure risk rather than confirmed malicious intent."},{"title":"Repository Mutation and Remote Push Workflow","locations":[{"file":"SKILL.md","line_end":70,"line_start":59},{"file":"SKILL.md","line_end":131,"line_start":129},{"file":"SKILL.md","line_end":158,"line_start":158}],"confidence":0.79,"description":"The skill instructs agents to add all files, create a commit, and push to the configured git remote after user approval. This can publish unintended local changes if the agent or user has not reviewed the working tree first.","confidence_reasoning":"The git commands are explicit and semantically relevant to deployment. The instruction requires user approval, which reduces but does not remove the risk of publishing unintended files."},{"title":"Global CLI Installation and Authentication Flow","locations":[{"file":"SKILL.md","line_end":148,"line_start":135},{"file":"SKILL.md","line_end":296,"line_start":294}],"confidence":0.72,"description":"The skill can ask the agent to install the Vercel CLI globally and run browser-based login. This is legitimate setup work, but it changes the user environment and depends on trusted npm package resolution.","confidence_reasoning":"The installation and login commands are visible in the documented workflow. They are normal for Vercel deployment, but they require user trust and environment changes."}],"low_findings":[{"title":"Environment File Detections Are Exclusion Rules","locations":[{"file":"resources/deploy.sh","line_end":206,"line_start":201},{"file":"resources/deploy-codex.sh","line_end":206,"line_start":201},{"file":"SKILL.md","line_end":185,"line_start":185}],"confidence":0.94,"description":"Static analysis flagged environment file references, but the scripts use those patterns to exclude .env files from the deployment archive. This reduces secret leakage for standard environment file names.","confidence_reasoning":"The cited lines show tar exclude rules and documentation stating .env files are excluded. This is a clear false positive for direct credential access."},{"title":"Markdown Command Examples Inflate External Command Count","locations":[{"file":"SKILL.md","line_end":31,"line_start":19},{"file":"SKILL.md","line_end":78,"line_start":65},{"file":"SKILL.md","line_end":217,"line_start":195}],"confidence":0.91,"description":"Many external command findings are command examples in SKILL.md, not hidden execution inside the skill metadata. They document expected deployment steps for an agent to run with user intent.","confidence_reasoning":"The detections occur inside fenced Markdown examples and procedural instructions. They are not obfuscated code or automatically executed by reading the skill."},{"title":"Hidden Home Directory Path Is Installation Guidance","locations":[{"file":"SKILL.md","line_end":236,"line_start":229}],"confidence":0.89,"description":"The hidden home directory path points to the typical Claude skill installation location. It does not read arbitrary hidden files or request secrets from the user home directory.","confidence_reasoning":"The path is shown as the script location for a terminal-based agent. No code around this citation reads unrelated hidden files."}],"dangerous_patterns":[{"title":"Shell Script Uploads User-Selected Project Archive","locations":[{"file":"resources/deploy.sh","line_end":239,"line_start":201},{"file":"resources/deploy-codex.sh","line_end":239,"line_start":201}],"confidence":0.9,"description":"The scripts create a tarball from the selected directory and POST it to a deployment API. This pattern is sensitive because the archive contents leave the local environment.","confidence_reasoning":"The tar and curl commands are direct evidence. The endpoint is deployment-related, so this is a risky pattern with legitimate context."},{"title":"Agent Workflow Uses Git and Vercel External Commands","locations":[{"file":"SKILL.md","line_end":78,"line_start":65},{"file":"SKILL.md","line_end":100,"line_start":88},{"file":"SKILL.md","line_end":146,"line_start":139},{"file":"SKILL.md","line_end":217,"line_start":195}],"confidence":0.84,"description":"The instructions direct agents to run git, npm, and vercel commands. These commands can mutate repositories, install packages, authenticate accounts, and deploy code.","confidence_reasoning":"The commands are explicit in the workflow. Their use is expected for deployment, but they remain privileged operational actions."}],"files_scanned":3,"total_lines":901,"audit_model":"codex","audited_at":"2026-06-30T22:08:39.806+00:00","created_at":"2026-07-07T02:37:21.713364+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":6,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}