Versioned security assessment

Report ID: SA-36E07D5E

7/7/2026, 8:59:28 AM

deploy-to-vercel security assessment v4

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
deploy-to-vercel
Version
v4
Maintainer
vercel-labs
Source
github.com/vercel-labs/agent-skills/tree/main/skills/deploy-to-vercel/
Coverage
3 Files scanned · 901 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

3 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most markdown backtick and shell-substitution alerts are formatting or quoted helper commands. Real risks remain in the fallback scripts because they upload project archives to fixed external deployment endpoints and poll returned URLs. No prompt injection text was found, but Archive.zip is an unnecessary binary review blind spot.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

3 Files scanned · 901 Lines analyzed

9 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 5 evidence locations

Filesystem access

May read or write local files.

Observed in 9 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 107 evidence locations

Capability review items (6)
High
resources/deploy-codex.sh:239
Shell command substitution
RESPONSE=$(curl -s -X POST "$DEPLOY_ENDPOINT" -F "file=@$TARBALL" -F "framework=$FRAMEWORK")
This curl posts the generated project tarball to a fixed external deployment endpoint. That is intended deployment behavior, but it exposes source files and requires explicit user consent.
High
resources/deploy-codex.sh:9
Hardcoded URL
DEPLOY_ENDPOINT="https://codex-deploy-skills.vercel.sh/api/deploy"
The hardcoded endpoint is later used to receive a project tarball through curl. Even if intended, this creates an external source-upload risk that requires explicit consent.
High
resources/deploy.sh:239
Shell command substitution
RESPONSE=$(curl -s -X POST "$DEPLOY_ENDPOINT" -F "file=@$TARBALL" -F "framework=$FRAMEWORK")
This curl posts the generated project tarball to a fixed external deployment endpoint. That is intended deployment behavior, but it exposes source files and requires explicit user consent.
High
resources/deploy.sh:9
Hardcoded URL
DEPLOY_ENDPOINT="https://claude-skills-deploy.vercel.com/api/deploy"
The hardcoded endpoint is later used to receive a project tarball through curl. Even if intended, this creates an external source-upload risk that requires explicit consent.
Medium
resources/deploy-codex.sh:266
Shell command substitution
HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$PREVIEW_URL")
The script curls PREVIEW_URL parsed from a remote response without domain validation. A compromised endpoint could cause outbound requests to unexpected hosts.
Medium
resources/deploy.sh:266
Shell command substitution
HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$PREVIEW_URL")
The script curls PREVIEW_URL parsed from a remote response without domain validation. A compromised endpoint could cause outbound requests to unexpected hosts.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (3)

RISK-001 High
SKILL.md:162-221resources/deploy.sh:237-240resources/deploy-codex.sh:237-240
Project Archive Upload to External Deployment Service
The fallback flow packages project files and posts the tarball to fixed deployment endpoints, then returns public preview and claim URLs. This can disclose source or unpublished content if run without clear consent.
The prose instructs fallback deployment and both scripts post the generated tarball to external endpoints. The data flow and public deployment outcome are explicit.
RISK-002 Medium
SKILL.md:59-70
Broad Git Commit and Push Workflow
The git deployment path instructs agents to add all files, commit, and push after one approval. Without a diff or secret review, unrelated files or credentials could be published.
The documented flow explicitly uses broad git add, commit, and push commands. The risk depends on local project contents, but the workflow is clear.
RISK-003 Medium
resources/deploy.sh:249-266resources/deploy-codex.sh:249-266
Unvalidated Returned URL Polling
The scripts parse previewUrl from the deployment response and curl it without checking the host. A compromised or unexpected response could drive outbound requests to unintended destinations.
The URL is derived from an external response and then used in curl. The script discards the body, so impact is limited but real.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Fallback deployment uploads project archives to fixed external endpoints.
    Require explicit user consent before fallback upload and document the exact endpoints and data sent.
  2. FIX-002
    Medium
    The git path uses broad commit and push commands.
    Show the pending diff and run a secret review before committing or pushing deployment changes.
  3. FIX-003
    Medium
    Returned preview URLs are polled without domain validation.
    Validate that preview URLs use expected Vercel domains before making follow-up network requests.
  4. FIX-004
    Medium
    Archive.zip is bundled with duplicate executable resources.
    Remove the archive from the published skill or publish only fully reviewable source files.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable