Vercel CLI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:53 AM UTC
• Version: 1.0.2

Overview

This Vercel CLI skill is coherent documentation, but it exposes high-impact deployment, secret, deletion, raw API, and purchase workflows without enough safety scoping for agent use.

Install only if you want an agent to help operate Vercel from the terminal. Use a least-privilege Vercel token, avoid unattended production/deletion/purchase/API actions, require explicit approval before `--prod`, `promote`, `rollback`, `remove`, `buy`, `api`, or domain changes, and treat pulled `.env` files as secrets that must stay gitignored and local.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

text

**CI/CD Environment (Recommended):**
1. Create an access token on the [Tokens page](https://vercel.com/account/tokens)
2. Set the `VERCEL_TOKEN` environment variable

> Prefer using the `VERCEL_TOKEN` environment variable over the `--token` flag to avoid exposing the token in process lists or logs.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

vercel pull and vercel env pull can copy remote environment variables and secrets into local files, but the skill does not warn that this may materialize sensitive credentials on disk. Without guidance on secure storage, .gitignore, file permissions, and cleanup, users may unintentionally leak secrets through source control, logs, backups, or shared workstations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill lists destructive commands such as rollback and remove without any warning or confirmation guidance, which increases the chance that a user or downstream agent executes an irreversible production-impacting action. In a deployment-management skill, omission of safety caveats around destructive operations can directly lead to outages, data loss, or accidental deletion of projects/deployments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file notes that deleting a project is permanent, but the command description broadly says it can remove a deployment or project without a prominent caution about destructive effects. For markdown safety guidance, destructive or irreversible operations should be clearly warned about so users understand the risk before invoking them.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation states that vercel env pull generates a local .env.local file but does not warn that this action copies remote secrets onto the local filesystem, where they may be exposed through accidental commits, insecure workstation storage, or other local tooling. In a CLI skill intended to guide agent actions, omission of this warning increases the chance that sensitive production or preview credentials are materialized locally without appropriate safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The vercel buy command can trigger billable purchases, but the reference does not prominently warn about financial impact or advise caution before use. In an agent-consumable CLI skill, omission of that warning can enable unintended charges if a user or automated workflow invokes the command without understanding that it performs real purchases.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.