Vercel

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:22 AM UTC
• Version: 1.0.0

Overview

This is a short Vercel deployment guide whose sensitive actions are disclosed and purpose-aligned, though users should pin the CLI and use scoped credentials.

Before installing or using this skill, prefer a pinned or project-local Vercel CLI, verify the Vercel project and Git repository before connecting auto-deploys, and use least-privilege Vercel credentials when adding production environment variables.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Vercel CLI Execution Through npx

Content

View full analysis

Remediation

View remediation

link npx --yes vercel@ git connect printf '%s' 'value' | npx --yes vercel@ env add VAR_NAME production npx --yes vercel@ domains ls ``` 2. Prefer declaring the CLI in the project's development dependencies and committing the package lockfile: ```bash npm install --save-dev --save-exact vercel@ npm ci npm exec --offline -- vercel link ``` 3. Review the resolved package and transitive dependencies before approving version changes. Use lockfile integrity metadata and automated dependency scanning. 4. Use a trusted npm registry and verify that project or user npm configuration cannot redirect the package name to an untrusted source. 5. Run deployment tooling with least-privilege credentials. Limit Vercel tokens to only the projects and operations required, and avoid exposing unrelated secrets in the invoking environment. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Using npx vercel without pinning a specific package version allows execution of whatever version npm resolves at runtime. This creates a supply-chain risk: a malicious or compromised newly published version, or an unexpected breaking update, could run arbitrary code during deployment-related operations.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

bash

cd <project-root>   # must be the directory with .git
npx vercel link      # link to Vercel project
npx vercel git connect  # connect GitHub repo for auto-deploys

Run vercel git connect from the repo root (where .git lives), not a subdirectory.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

npx vercel git connect without version pinning fetches and executes the CLI version available at invocation time. Because this command links repositories and configures deployment integration, an untrusted or changed package version could affect source control and deployment settings with the user's privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Piping a secret into npx vercel env add still relies on executing an unpinned package version at runtime. If the resolved CLI were malicious or compromised, it could exfiltrate the provided environment variable value or alter project configuration unexpectedly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

Even a read-oriented command like npx vercel domains ls executes code from an unpinned package source. While lower risk than secret-handling commands, it still exposes users to arbitrary code execution or unexpected behavior if the package resolution is compromised.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.