ClawHub

Vercel

Security checks across malware telemetry and agentic risk

Overview

This is a plain Vercel CLI reference skill with no bundled code, though it includes commands that can affect live projects and secrets if run carelessly.

Install this only if you want an agent to help with Vercel operations. Before allowing mutating commands, confirm the active Vercel account and team, exact project or deployment target, production impact, billing/domain effects, and whether secrets or .env files could be exposed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill documents production-affecting and destructive Vercel commands such as promote, rollback, redeploy, domain changes, and deployment removal without any warning about confirmation, scope validation, or production impact. In an agent setting, this increases the chance of accidental execution against the wrong project, environment, or team, leading to outages or unintended changes.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The environment variable section includes commands to list, add, remove, and pull secrets into local files, but it does not warn that these values may be sensitive credentials or that pulled files such as .env.local must be protected. In an agent workflow, this can cause secret disclosure to logs, terminal output, chat transcripts, or accidental commits.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal