Vercel Deployment Watchdog

• Outcome: Review
• Latest audit: May 29, 2026, 9:28 PM
• Version:
  1.0.0

Overview

This appears to be a legitimate Vercel monitoring skill, but one safety control is weaker than the documentation claims.

Review or patch the URL validation before installing, especially if the agent may receive arbitrary URLs. Use only URLs you own or are authorized to monitor, provide a least-privilege Vercel token, avoid --verbose as a way to bypass internal URL checks, and configure any cron or sub-agent job deliberately with a clear schedule and notification target.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 76% confidence
• Finding: The skill advertises executable shell-based behavior and dependency installation guidance but does not declare corresponding permissions, creating a mismatch between stated capability boundaries and actual execution potential. This can weaken policy enforcement and user understanding, especially because the skill performs network-facing monitoring with curl and scripted execution.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The help text states that internal/private URL checks are enabled by default, but the actual validation logic allows localhost and some internal-domain URLs to proceed when --verbose is set, even without ALLOW_INTERNAL. In a monitoring skill that performs outbound HTTP requests, this weakens SSRF protections and can mislead users into thinking internal targets are blocked when they are not.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The cron payload phrase 'Run deployment watchdog check and notify if any failures' is generic enough that it could overlap with an ordinary user request, causing the wrong automation path or unintended execution context to trigger. In agent systems, ambiguous trigger phrases can lead to unauthorized or surprising actions, especially for recurring jobs with notification side effects.

VirusTotal

66/66 vendors flagged this skill as clean.