📦
Audit History
deploy-to-vercel - 5 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v5 Latest | Jul 7, 2026, 08:59 AM | 3 confirmed | 6 | No capability change |
| v4 | Jul 7, 2026, 08:59 AM | 3 confirmed | 6 | Contains scripts |
| v3 | Jun 30, 2026, 10:08 PM | No confirmed findings | 6 | No capability change |
| v2 | Jun 30, 2026, 10:08 PM | No confirmed findings | 6 | Contains scripts |
| v1 | Mar 20, 2026, 08:20 AM | 4 confirmed | 0 | Baseline |
Audit version 5 Latest
Jul 7, 2026, 08:59 AM
Most markdown backtick and shell-substitution alerts are formatting or quoted helper commands. Real risks remain in the fallback scripts because they upload project archives to fixed external deployment endpoints and poll returned URLs. No prompt injection text was found, but Archive.zip is an unnecessary binary review blind spot.
3
Files scanned
901
Lines analyzed
12
Review items
0
False positives ignored
Confirmed security concerns (3)
High
Project Archive Upload to External Deployment Service
The fallback flow packages project files and posts the tarball to fixed deployment endpoints, then returns public preview and claim URLs. This can disclose source or unpublished content if run without clear consent.
The prose instructs fallback deployment and both scripts post the generated tarball to external endpoints. The data flow and public deployment outcome are explicit.
Medium
Broad Git Commit and Push Workflow
The git deployment path instructs agents to add all files, commit, and push after one approval. Without a diff or secret review, unrelated files or credentials could be published.
The documented flow explicitly uses broad git add, commit, and push commands. The risk depends on local project contents, but the workflow is clear.
Medium
Unvalidated Returned URL Polling
The scripts parse previewUrl from the deployment response and curl it without checking the host. A compromised or unexpected response could drive outbound requests to unintended destinations.
The URL is derived from an external response and then used in curl. The script discards the body, so impact is limited but real.
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Shell command substitution · 2 occurrences
RESPONSE=$(curl -s -X POST "$DEPLOY_ENDPOINT" -F "file=@$TARBALL" -F "framework=$FRAMEWORK")
This curl posts the generated project tarball to a fixed external deployment endpoint. That is intended deployment behavior, but it exposes source files and requires explicit user consent.
High
Hardcoded URL
DEPLOY_ENDPOINT="https://codex-deploy-skills.vercel.sh/api/deploy"
The hardcoded endpoint is later used to receive a project tarball through curl. Even if intended, this creates an external source-upload risk that requires explicit consent.
High
Hardcoded URL
DEPLOY_ENDPOINT="https://claude-skills-deploy.vercel.com/api/deploy"
The hardcoded endpoint is later used to receive a project tarball through curl. Even if intended, this creates an external source-upload risk that requires explicit consent.
Medium
Shell command substitution · 2 occurrences
HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$PREVIEW_URL")
The script curls PREVIEW_URL parsed from a remote response without domain validation. A compromised endpoint could cause outbound requests to unexpected hosts.
Risk Factors
⚙️ External commands (107)
resources/deploy-codex.sh:20 resources/deploy-codex.sh:168 resources/deploy-codex.sh:193 resources/deploy-codex.sh:196 resources/deploy-codex.sh:211 resources/deploy-codex.sh:212 resources/deploy-codex.sh:216 resources/deploy-codex.sh:217 resources/deploy-codex.sh:239 resources/deploy-codex.sh:243 resources/deploy-codex.sh:249 resources/deploy-codex.sh:250 resources/deploy-codex.sh:266 resources/deploy-codex.sh:274 resources/deploy-codex.sh:276 resources/deploy-codex.sh:1 resources/deploy.sh:20 resources/deploy.sh:168 resources/deploy.sh:193 resources/deploy.sh:196 resources/deploy.sh:211 resources/deploy.sh:212 resources/deploy.sh:216 resources/deploy.sh:217 resources/deploy.sh:239 resources/deploy.sh:243 resources/deploy.sh:249 resources/deploy.sh:250 resources/deploy.sh:266 resources/deploy.sh:274 resources/deploy.sh:276 resources/deploy.sh:1 SKILL.md:19-31 SKILL.md:31-37 SKILL.md:37 SKILL.md:39-41 SKILL.md:41-43 SKILL.md:43 SKILL.md:45-46 SKILL.md:46 SKILL.md:47 SKILL.md:51 SKILL.md:55-60 SKILL.md:60-63 SKILL.md:63-66 SKILL.md:66-70 SKILL.md:70-71 SKILL.md:71-74 SKILL.md:74-77 SKILL.md:77-78 SKILL.md:78 SKILL.md:84 SKILL.md:88-90 SKILL.md:90-92 SKILL.md:92-94 SKILL.md:94-96 SKILL.md:96-99 SKILL.md:99-101 SKILL.md:101-112 SKILL.md:112-115 SKILL.md:115-118 SKILL.md:118-120 SKILL.md:120-121 SKILL.md:121 SKILL.md:124-126 SKILL.md:126-127 SKILL.md:127-131 SKILL.md:131 SKILL.md:140-142 SKILL.md:142-145 SKILL.md:145-147 SKILL.md:147-150 SKILL.md:150-152 SKILL.md:152 SKILL.md:153-156 SKILL.md:156-158 SKILL.md:158 SKILL.md:166-168 SKILL.md:168-171 SKILL.md:171 SKILL.md:174-183 SKILL.md:183-185 SKILL.md:185 SKILL.md:196-198 SKILL.md:198-200 SKILL.md:200-201 SKILL.md:201-203 SKILL.md:203-205 SKILL.md:205-206 SKILL.md:206-217 SKILL.md:217-219 SKILL.md:219 SKILL.md:223 SKILL.md:231-234 SKILL.md:234-236 SKILL.md:236-241 SKILL.md:241 SKILL.md:253-254 SKILL.md:254 SKILL.md:256-264 SKILL.md:264-276 SKILL.md:276-282 SKILL.md:282-286 SKILL.md:286-289 SKILL.md:289-292 SKILL.md:292-296 SKILL.md:296
🌐 Network access (5)
Audited by: codex
Jul 7, 2026, 08:59 AM
Most markdown backtick and shell-substitution alerts are formatting or quoted helper commands. Real risks remain in the fallback scripts because they upload project archives to fixed external deployment endpoints and poll returned URLs. No prompt injection text was found, but Archive.zip is an unnecessary binary review blind spot.
3
Files scanned
901
Lines analyzed
12
Review items
0
False positives ignored
Confirmed security concerns (3)
High
Project Archive Upload to External Deployment Service
The fallback flow packages project files and posts the tarball to fixed deployment endpoints, then returns public preview and claim URLs. This can disclose source or unpublished content if run without clear consent.
The prose instructs fallback deployment and both scripts post the generated tarball to external endpoints. The data flow and public deployment outcome are explicit.
Medium
Broad Git Commit and Push Workflow
The git deployment path instructs agents to add all files, commit, and push after one approval. Without a diff or secret review, unrelated files or credentials could be published.
The documented flow explicitly uses broad git add, commit, and push commands. The risk depends on local project contents, but the workflow is clear.
Medium
Unvalidated Returned URL Polling
The scripts parse previewUrl from the deployment response and curl it without checking the host. A compromised or unexpected response could drive outbound requests to unintended destinations.
The URL is derived from an external response and then used in curl. The script discards the body, so impact is limited but real.
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Shell command substitution · 2 occurrences
RESPONSE=$(curl -s -X POST "$DEPLOY_ENDPOINT" -F "file=@$TARBALL" -F "framework=$FRAMEWORK")
This curl posts the generated project tarball to a fixed external deployment endpoint. That is intended deployment behavior, but it exposes source files and requires explicit user consent.
High
Hardcoded URL
DEPLOY_ENDPOINT="https://codex-deploy-skills.vercel.sh/api/deploy"
The hardcoded endpoint is later used to receive a project tarball through curl. Even if intended, this creates an external source-upload risk that requires explicit consent.
High
Hardcoded URL
DEPLOY_ENDPOINT="https://claude-skills-deploy.vercel.com/api/deploy"
The hardcoded endpoint is later used to receive a project tarball through curl. Even if intended, this creates an external source-upload risk that requires explicit consent.
Medium
Shell command substitution · 2 occurrences
HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$PREVIEW_URL")
The script curls PREVIEW_URL parsed from a remote response without domain validation. A compromised endpoint could cause outbound requests to unexpected hosts.
Risk Factors
⚙️ External commands (107)
resources/deploy-codex.sh:20 resources/deploy-codex.sh:168 resources/deploy-codex.sh:193 resources/deploy-codex.sh:196 resources/deploy-codex.sh:211 resources/deploy-codex.sh:212 resources/deploy-codex.sh:216 resources/deploy-codex.sh:217 resources/deploy-codex.sh:239 resources/deploy-codex.sh:243 resources/deploy-codex.sh:249 resources/deploy-codex.sh:250 resources/deploy-codex.sh:266 resources/deploy-codex.sh:274 resources/deploy-codex.sh:276 resources/deploy-codex.sh:1 resources/deploy.sh:20 resources/deploy.sh:168 resources/deploy.sh:193 resources/deploy.sh:196 resources/deploy.sh:211 resources/deploy.sh:212 resources/deploy.sh:216 resources/deploy.sh:217 resources/deploy.sh:239 resources/deploy.sh:243 resources/deploy.sh:249 resources/deploy.sh:250 resources/deploy.sh:266 resources/deploy.sh:274 resources/deploy.sh:276 resources/deploy.sh:1 SKILL.md:19-31 SKILL.md:31-37 SKILL.md:37 SKILL.md:39-41 SKILL.md:41-43 SKILL.md:43 SKILL.md:45-46 SKILL.md:46 SKILL.md:47 SKILL.md:51 SKILL.md:55-60 SKILL.md:60-63 SKILL.md:63-66 SKILL.md:66-70 SKILL.md:70-71 SKILL.md:71-74 SKILL.md:74-77 SKILL.md:77-78 SKILL.md:78 SKILL.md:84 SKILL.md:88-90 SKILL.md:90-92 SKILL.md:92-94 SKILL.md:94-96 SKILL.md:96-99 SKILL.md:99-101 SKILL.md:101-112 SKILL.md:112-115 SKILL.md:115-118 SKILL.md:118-120 SKILL.md:120-121 SKILL.md:121 SKILL.md:124-126 SKILL.md:126-127 SKILL.md:127-131 SKILL.md:131 SKILL.md:140-142 SKILL.md:142-145 SKILL.md:145-147 SKILL.md:147-150 SKILL.md:150-152 SKILL.md:152 SKILL.md:153-156 SKILL.md:156-158 SKILL.md:158 SKILL.md:166-168 SKILL.md:168-171 SKILL.md:171 SKILL.md:174-183 SKILL.md:183-185 SKILL.md:185 SKILL.md:196-198 SKILL.md:198-200 SKILL.md:200-201 SKILL.md:201-203 SKILL.md:203-205 SKILL.md:205-206 SKILL.md:206-217 SKILL.md:217-219 SKILL.md:219 SKILL.md:223 SKILL.md:231-234 SKILL.md:234-236 SKILL.md:236-241 SKILL.md:241 SKILL.md:253-254 SKILL.md:254 SKILL.md:256-264 SKILL.md:264-276 SKILL.md:276-282 SKILL.md:282-286 SKILL.md:286-289 SKILL.md:289-292 SKILL.md:292-296 SKILL.md:296
🌐 Network access (5)
Audited by: codex
Jun 30, 2026, 10:08 PM
Static analysis found extensive shell, network, and filesystem activity. Review confirms these patterns are expected for a Vercel deployment skill, but the fallback scripts package project files and upload them to external deploy endpoints, so publication should include a clear warning. No prompt injection text or confirmed malicious intent was found.
3
Files scanned
901
Lines analyzed
10
Review items
0
False positives ignored
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
resources/deploy.sh:201-206resources/deploy.sh:227-239resources/deploy-codex.sh:201-206resources/deploy-codex.sh:227-239SKILL.md:162-185SKILL.md:191-221
Project Archive Upload to External Deployment Endpoint
The fallback scripts stage the selected project, create an archive, and upload it with curl to Vercel-hosted deployment endpoints. This is expected for deployment, but it can disclose project files if a user points the script at the wrong directory or stores secrets outside excluded environment files.
The scripts clearly tar project files and POST the archive to fixed deployment endpoints. The behavior matches the skill purpose, so the concern is disclosure risk rather than confirmed malicious intent.
Medium
Repository Mutation and Remote Push Workflow
The skill instructs agents to add all files, create a commit, and push to the configured git remote after user approval. This can publish unintended local changes if the agent or user has not reviewed the working tree first.
The git commands are explicit and semantically relevant to deployment. The instruction requires user approval, which reduces but does not remove the risk of publishing unintended files.
Medium
Global CLI Installation and Authentication Flow
The skill can ask the agent to install the Vercel CLI globally and run browser-based login. This is legitimate setup work, but it changes the user environment and depends on trusted npm package resolution.
The installation and login commands are visible in the documented workflow. They are normal for Vercel deployment, but they require user trust and environment changes.
Low
Environment File Detections Are Exclusion Rules
Static analysis flagged environment file references, but the scripts use those patterns to exclude .env files from the deployment archive. This reduces secret leakage for standard environment file names.
The cited lines show tar exclude rules and documentation stating .env files are excluded. This is a clear false positive for direct credential access.
Low
Markdown Command Examples Inflate External Command Count
Many external command findings are command examples in SKILL.md, not hidden execution inside the skill metadata. They document expected deployment steps for an agent to run with user intent.
The detections occur inside fenced Markdown examples and procedural instructions. They are not obfuscated code or automatically executed by reading the skill.
Low
Hidden Home Directory Path Is Installation Guidance
The hidden home directory path points to the typical Claude skill installation location. It does not read arbitrary hidden files or request secrets from the user home directory.
The path is shown as the script location for a terminal-based agent. No code around this citation reads unrelated hidden files.
Risk Factors
⚡ Contains scripts (4)
🌐 Network access (8)
📁 Filesystem access (8)
⚙️ External commands (12)
Detected Patterns
Shell Script Uploads User-Selected Project ArchiveAgent Workflow Uses Git and Vercel External Commands
Audited by: codex
Jun 30, 2026, 10:08 PM
Static analysis found extensive shell, network, and filesystem activity. Review confirms these patterns are expected for a Vercel deployment skill, but the fallback scripts package project files and upload them to external deploy endpoints, so publication should include a clear warning. No prompt injection text or confirmed malicious intent was found.
3
Files scanned
901
Lines analyzed
10
Review items
0
False positives ignored
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
resources/deploy.sh:201-206resources/deploy.sh:227-239resources/deploy-codex.sh:201-206resources/deploy-codex.sh:227-239SKILL.md:162-185SKILL.md:191-221
Project Archive Upload to External Deployment Endpoint
The fallback scripts stage the selected project, create an archive, and upload it with curl to Vercel-hosted deployment endpoints. This is expected for deployment, but it can disclose project files if a user points the script at the wrong directory or stores secrets outside excluded environment files.
The scripts clearly tar project files and POST the archive to fixed deployment endpoints. The behavior matches the skill purpose, so the concern is disclosure risk rather than confirmed malicious intent.
Medium
Repository Mutation and Remote Push Workflow
The skill instructs agents to add all files, create a commit, and push to the configured git remote after user approval. This can publish unintended local changes if the agent or user has not reviewed the working tree first.
The git commands are explicit and semantically relevant to deployment. The instruction requires user approval, which reduces but does not remove the risk of publishing unintended files.
Medium
Global CLI Installation and Authentication Flow
The skill can ask the agent to install the Vercel CLI globally and run browser-based login. This is legitimate setup work, but it changes the user environment and depends on trusted npm package resolution.
The installation and login commands are visible in the documented workflow. They are normal for Vercel deployment, but they require user trust and environment changes.
Low
Environment File Detections Are Exclusion Rules
Static analysis flagged environment file references, but the scripts use those patterns to exclude .env files from the deployment archive. This reduces secret leakage for standard environment file names.
The cited lines show tar exclude rules and documentation stating .env files are excluded. This is a clear false positive for direct credential access.
Low
Markdown Command Examples Inflate External Command Count
Many external command findings are command examples in SKILL.md, not hidden execution inside the skill metadata. They document expected deployment steps for an agent to run with user intent.
The detections occur inside fenced Markdown examples and procedural instructions. They are not obfuscated code or automatically executed by reading the skill.
Low
Hidden Home Directory Path Is Installation Guidance
The hidden home directory path points to the typical Claude skill installation location. It does not read arbitrary hidden files or request secrets from the user home directory.
The path is shown as the script location for a terminal-based agent. No code around this citation reads unrelated hidden files.
Risk Factors
⚡ Contains scripts (4)
🌐 Network access (8)
📁 Filesystem access (8)
⚙️ External commands (12)
Detected Patterns
Shell Script Uploads User-Selected Project ArchiveAgent Workflow Uses Git and Vercel External Commands
Audited by: codex
Mar 20, 2026, 08:20 AM
Evaluated 168 static findings across 3 files (901 lines). All external command patterns in SKILL.md are documentation examples, not vulnerabilities. Environment file access (lines 204-205) is security-positive—the script explicitly excludes .env files. Network access is limited to Vercel's official deployment API. The skill demonstrates proper security practices and is safe for publication.
3
Files scanned
901
Lines analyzed
7
Review items
0
False positives ignored
Confirmed security concerns (4)
High
Environment File Access in Deploy Scripts
The deploy scripts read .env file access at lines 204-205. Upon inspection, these are SECURITY-POSITIVE patterns that explicitly EXCLUDE .env files from deployment packages to prevent credential leaks. The tar commands use --exclude='.env' and --exclude='.env.*' to protect sensitive credentials from being deployed.
Direct inspection of lines 204-205 confirms the script explicitly excludes .env files from deployment packages, which is a security best practice.
Low
Shell Command Substitution in SKILL.md
The SKILL.md file contains bash code blocks with backtick syntax for displaying command examples. These are documentation examples, not actual code execution. The static scanner incorrectly flags markdown-rendered bash examples as Ruby/shell backtick execution.
SKILL.md is a markdown documentation file. All command patterns are bash code blocks within markdown fences, not executable code.
Low
Weak Cryptographic Algorithm Flag
The static scanner flagged 'description' metadata and 'git commit -m' as weak cryptographic algorithms. These are false positives - 'description' is a YAML metadata field, and 'git commit -m' is a standard version control command, not cryptography.
Line 3 is YAML frontmatter 'description:', and line 68 is 'git commit -m'. Neither involves cryptographic algorithms.
Low
System Reconnaissance Commands
Commands like 'vercel whoami' and 'command -v vercel' are standard pre-flight checks to determine if the Vercel CLI is installed and authenticated. These are legitimate checks required for the skill to function.
These commands check CLI availability and authentication status, which is required behavior for a deployment skill.
Risk Factors
⚙️ External commands (32)
resources/deploy-codex.sh:20 resources/deploy-codex.sh:168 resources/deploy-codex.sh:193 resources/deploy-codex.sh:196 resources/deploy-codex.sh:211 resources/deploy-codex.sh:212 resources/deploy-codex.sh:216 resources/deploy-codex.sh:217 resources/deploy-codex.sh:239 resources/deploy-codex.sh:243 resources/deploy-codex.sh:249 resources/deploy-codex.sh:250 resources/deploy-codex.sh:266 resources/deploy-codex.sh:274 resources/deploy-codex.sh:276 resources/deploy-codex.sh:1 resources/deploy.sh:20 resources/deploy.sh:168 resources/deploy.sh:193 resources/deploy.sh:196 resources/deploy.sh:211 resources/deploy.sh:212 resources/deploy.sh:216 resources/deploy.sh:217 resources/deploy.sh:239 resources/deploy.sh:243 resources/deploy.sh:249 resources/deploy.sh:250 resources/deploy.sh:266 resources/deploy.sh:274 resources/deploy.sh:276 resources/deploy.sh:1
🌐 Network access (2)
📁 Filesystem access (4)
Audited by: claude