Versioned security assessment

Report ID: SA-F93E9BB0

7/7/2026, 4:40:06 AM

vercel-automation security assessment v4

Skill Security Certification Report

Audit History
Audit model: codex Latest published report
Skill name
vercel-automation
Version
v4
Maintainer
sickn33
Source
github.com/sickn33/antigravity-awesome-skills/tree/main/skills/vercel-automation
Coverage
1 Files scanned · 227 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

2 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static external command findings are false positives caused by markdown backticks around tool names, parameters, and examples. The real risks are the external Rube MCP endpoint, Vercel OAuth trust boundary, and write-capable Vercel workflows that can affect production deployments, DNS, project settings, and environment variables.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 227 Lines analyzed

3 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 1 evidence location

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 66 evidence locations

Capability review items (1)
Medium
SKILL.md:20
Hardcoded URL
**Get Rube MCP**: Add `https://rube.app/mcp` as an MCP server in your client configuration. No API k
Line 20 instructs users to configure https://rube.app/mcp as an MCP server, so the skill depends on an external network service. This is expected for Rube MCP but expands trust boundaries for Vercel data and actions.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 Medium
SKILL.md:20SKILL.md:24-25
Third-Party MCP OAuth Trust Boundary
The skill tells users to add the Rube MCP endpoint and complete Vercel OAuth through that connection. This is an intended integration, but it gives an external MCP service access to Vercel operations and metadata.
The setup instructions explicitly name the external MCP endpoint and Vercel OAuth flow. The risk is contextual trust expansion, not hidden malicious behavior.
RISK-002 Medium
SKILL.md:60SKILL.md:82-83SKILL.md:107-108SKILL.md:130
High-Impact Vercel Write Operations
The skill guides agents to create deployments, add or delete environment variables, create or update DNS records, and update project settings. These are valid DevOps actions but can disrupt production if run without approval gates.
The cited workflow steps directly include write-capable Vercel operations. The skill frames them as legitimate administration, so the finding is operational risk rather than malicious intent.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    External MCP service receives privileged Vercel access.
    Document the Rube MCP data flow, OAuth permissions, and trust boundary before users connect their Vercel account.
  2. FIX-002
    Medium
    Production and DNS workflows can cause service disruption.
    Require explicit user confirmation before production deployments, DNS create or update actions, project updates, and environment variable deletion.
  3. FIX-003
    Medium
    Environment variable workflows can handle sensitive values.
    Tell agents not to print secret values, and prefer secret or sensitive variable types when adding credentials.
  4. FIX-004
    Low
    Markdown backticks triggered external command false positives.
    Consider documenting tool names in tables or plain text if marketplace scanners treat markdown code spans as executable patterns.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
f93e9bb0daca99badb6a7e574b97737155d57cb3
Content hash
08c35e0fa4ca6b763842fcb48c7e55878c36a6e25fac9bda7f188c5e63170a9f
Tree hash
9690f1071041334e357b46b4e06c15df253c3396bec4f2f51dc67b89512a335b
Skill path
skills/sickn33/vercel-automation
Audit payload hash
26e04ccea97858d8d485234a00328c9b

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable