Vercel

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:21 PM UTC
• Version: 1.0.0

Overview

This Vercel skill is mostly a straightforward CLI reference, but it includes production and destructive account actions without enough safety guidance.

Install only if you want an agent to help operate Vercel. Require explicit confirmation before production deploys, promotion, rollback, removing projects/domains/env vars, pulling env files, switching teams, or using `--yes`. Prefer a pinned or project-local Vercel CLI install when possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Global Installation of the Vercel CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5 and 13
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

yaml

install_command: "npm i -g vercel"

bash

npm i -g vercel

Technical Analysis

The Skill instructs users or agents to install the vercel npm package globally without specifying an audited version or enforcing package-integrity verification. Consequently, the package resolved at installation time may differ from the version that existed when the Skill was reviewed.

The -g option installs the dependency into the user's global npm environment. npm packages may execute lifecycle scripts during installation, and the resulting CLI executes with the privileges of the invoking account. If the package, one of its transitive dependencies, the configured npm registry, or a future release is compromised, attacker-controlled code could execute during installation or subsequent CLI use.

Attack Path

1. An attacker compromises a future vercel package release, a transitive dependency, a maintainer account, or the npm registry path used by the environment.
2. A user or agent follows the Skill instructions and executes npm i -g vercel.
3. npm resolves the current package version rather than a previously audited and fixed version.
4. Malicious package or lifecycle code executes with the invoking user's privileges.
5. The malicious code accesses resources available to that account, which may include local source code, environment data, npm configuration, and authenticated Vercel credentials or projects.

Impact Assessment

Successful exploitation could provide code execution with the privileges of the account running npm. The affected scope may include files readable or writable by that account, its global npm installation area, local project contents, environment variables, and credentials available to the proces ...[truncated 308 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to a specifically reviewed version, for example:

  bash

  npm install --global vercel@<reviewed-version>
  

• Prefer a project-local development dependency governed by a committed lockfile instead of a global installation:

  bash

  npm install --save-dev --save-exact vercel@<reviewed-version>
  

• Use npm ci with a reviewed lockfile in automated environments to ensure deterministic dependency resolution.
• Verify package provenance and integrity through the official npm registry, registry allowlisting, package signatures or attestations where supported, and lockfile integrity hashes.
• Review the pinned package and its transitive dependencies before updating. Apply updates through a controlled dependency-review process.
• Avoid elevated privileges when installing or invoking the CLI, and run deployment tooling in a restricted environment with only the Vercel permissions required for the requested operation.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description says to use the skill when the user mentions 'deploy' or 'wants to interact with Vercel.' 'deploy' is a broad term that can apply to many platforms and workflows, making activation scope ambiguous. The file does not provide exclusion conditions or narrower trigger constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill documents destructive commands such as removing projects, domains, and environment variables without any warning, confirmation guidance, or requirement for explicit user confirmation. In an agent context, this increases the risk of accidental or overly eager execution causing irreversible service disruption or loss of configuration.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Advertising the global --yes flag normalizes bypassing confirmation prompts, which can let an automated agent perform destructive or high-impact Vercel actions without a safety checkpoint. In combination with commands that modify production deployments, domains, projects, or environment variables, this materially increases the chance of unintended changes.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

| `--json` | Output result as JSON |
| `--token <token>` | Login token |
| `--scope <team>` | Set scope to a team |
| `--yes` | Skip confirmation prompts |
| `--cwd <path>` | Set working directory |
| `--debug` | Enable debug output |

Static analysis

No suspicious patterns detected.