Vercel Config Generator

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:16 AM UTC
• Version: 1.0.0

Overview

The skill is a small Vercel config generator, but it silently overwrites an existing vercel.json and advertises deployment modes it does not actually implement.

Review before installing or running in an existing project. It should be treated as a simple fixed vercel.json writer, not a full Vercel configuration generator. Run it only in a clean directory or after backing up any existing vercel.json, and do not rely on the documented --type, --framework, or --region examples to change its output.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: vercel-config-generator.sh:4

Finding

Unconditional Overwrite of Existing Vercel Configuration

Content

View full analysis

Vulnerability Details

File Location: vercel-config-generator.sh, lines 4–14
Vulnerability Type: Destructive file overwrite without confirmation or backup
Risk Level: Medium

Vulnerable Code

bash

cat > vercel.json << 'JSON'
{
  "buildCommand": "npm run build",
  "outputDirectory": "dist",
  "framework": null,
  "functions": {
    "api/**/*.js": {
      "runtime": "nodejs18.x"
    }
  }
}
JSON

Technical Analysis

The > redirection operator creates vercel.json or truncates it if it already exists. The script does not check for an existing configuration, request confirmation, create a backup, or write the new content atomically.

Consequently, invoking the generator in an existing project silently destroys the project's current Vercel configuration and replaces it with a fixed Serverless configuration. The TYPE variable assigned earlier in the script is unused, so supplied deployment-mode arguments do not alter or prevent this behavior.

This is an insecure coding practice because a routine generation operation can cause irreversible configuration loss and alter subsequent deployment behavior without adequately informing the operator.

Attack Path

1. A user has a project containing a trusted vercel.json with application-specific routes, headers, runtime settings, or access controls.
2. The user invokes the generator according to its documented usage, potentially supplying an advertised deployment mode.
3. The shell opens the existing vercel.json with truncation enabled.
4. The original configuration is discarded and replaced with the hardcoded content.
5. A later Vercel deployment uses the unintended configuration, potentially omitting required deployment or security settings.

Exploitation requires the script to run with write access to the project directory. No privilege escalation beyond the invoking user's filesystem permissions was identified.

Imp

...[truncated 669 chars]

Remediation

View remediation

Remediation Suggestions

1. Check whether vercel.json already exists and refuse to overwrite it by default.
2. Require an explicit option such as --force before replacing an existing file.
3. Display a clear warning and request confirmation when running interactively.
4. Preserve the original file in a timestamped backup before replacement.
5. Generate the new configuration in a securely created temporary file, validate it as JSON, and then atomically rename it into place.
6. Implement the documented type, framework, and region arguments, or reject unsupported arguments with a nonzero exit status.
7. Use strict shell settings and error handling, such as set -euo pipefail, so failures do not produce incomplete or misleading results.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

描述强调这是一个可生成专业 Vercel 配置且支持多种部署模式的工具，但代码实际只是无条件写出一个静态 vercel.json 模板。该模板主要针对带有 Node.js Serverless Function 的构建场景，没有根据输入切换不同部署模式，也没有任何 Edge Functions、静态站点专用或 SSR 专用配置逻辑。因此其主要能力被明显夸大，描述与实际行为存在实质性不一致。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description and main content are written as an instructionally Chinese-only skill, with no indication that users may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language locale violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description is written only in Chinese ("生成 Vercel 配置"), which indicates a fixed language presentation without any accompanying user choice or locale justification. The policy requires avoiding forced language or locale constraints unless the skill explicitly offers opt-in or documents a justified regional scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description says the skill supports Serverless Functions, Edge Functions, static sites, SSR, and other deployment modes. However, the code ignores the TYPE argument and unconditionally writes one fixed configuration with a Node.js functions block for api/**/*.js, which does not implement the advertised multi-mode behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.