Security risk report for @forgecat/vercel-labs_agent-skills_deploy-to-vercel v0.0.9
Source Integrity
Low
Profile is sourced from upstream Vercel Labs agent-skills repository (pinned commit 063bee94c3f4df8453406c830b0a7df0f2860278), with clear provenance documented in LICENSE-SOURCE.md.
ForgeCat has transparently separated upstream content from ForgeCat-added reference material (MIT-STANDARD-REFERENCE.md, README.md); upstream absence of copyright notice is disclosed.
No typosquatted dependencies, attacker-controlled packages, or supply-chain substitutions are introduced.
Agent Intent
Low
Profile contains legitimate deployment instructions for Vercel CLI workflows; no prompt injection, role hijack, or system prompt leakage attempts are present.
Instructions do not direct reading of sensitive files (e.g., ~/.ssh, ~/.aws, .env) for exfiltration, nor do they instruct hiding or denying the profile's own instructions.
Guidance is standard Vercel deployment practice (git push, CLI linking, team selection) — no malicious knowledge poisoning, typosquatted packages, or security-weakening defaults are embedded.
Details
Evidence
Step 1 checks `.vercel/` config files for legitimate project state detection, not credential exfiltration.
Step 2 methods (git push, `vercel deploy`, `vercel link`) are documented Vercel CLI operations with no hidden payloads.
No-auth fallback uses a local script (`/mnt/skills/user/deploy-to-vercel/resources/deploy.sh`) for sandboxed environments — no external URL fetching or remote code execution.
Permissions
PRM-000Medium
The skill instructs execution of shell commands (`git add`, `git commit`, `git push`, `npm install -g vercel`, `vercel deploy`) which constitute shell and file-mutate category operations.
These operations are broadly scoped — committing and pushing all files (`git add .`) and installing global npm packages — though they are consistent with the stated deployment purpose.
The authority is somewhat broader than a minimal deployment helper (global npm install, git history mutation, potential production deploy if user requests), but not wildly excessive given the declared function.
Details
Evidence
"git add . / git commit -m ... / git push" — mutates git history and pushes to remote
"npm install -g vercel" — installs a global package on the user's system
"vercel deploy [path] --prod -y --no-wait" — production deployment path exists, gated on user request
MCP Risk
Low
No MCP servers are declared in the profile; all operations are CLI-based (Vercel CLI, git, npm, bash).
External network access is limited to Vercel's official services (vercel.com, git providers) — no arbitrary host access or unknown binary execution.
The fallback script (`deploy.sh`) is referenced as a local resource in a sandboxed environment; no hidden instructions or unrestricted filesystem access are evident.
Details
Evidence
Profile metadata declares no MCP servers.
All external calls target Vercel's official CLI and services, not arbitrary third-party hosts.
Script path `/mnt/skills/user/deploy-to-vercel/resources/deploy.sh` is a known local resource, not a remote payload.
ForgeCat