Uncategorized

deploy-to-vercel

Gold
Vercel
11,807 tokensgemini-3-flash-preview

Safety Score

75/ 100

Detected Capabilities

filesystem_readnetworkenv_accessfilesystem_write

Sensitive Files

    Clean filesystem scan

Deep Audit Findings

This skill facilitates Vercel deployments via the CLI or fallback scripts. While the CLI method is standard, the 'No-Auth Fallback' scripts (deploy.sh and deploy-codex.sh) function by packaging the entire project and uploading it to external proxy endpoints (claude-skills-deploy.vercel.com and codex-deploy-skills.vercel.sh). This transmits the user's source code to a third-party service to generate 'Claim URLs'. While it attempts to exclude .env files, other sensitive files or hardcoded secrets are still at risk of exfiltration to these intermediate endpoints.

Code Exfiltration to Proxy Endpoints

The fallback mechanism uploads the user's entire project directory as a tarball to unauthenticated endpoints. If these endpoints are compromised or malicious, the user's proprietary source code is exposed.

MEDIUM
resources/deploy.sh
DEPLOY_ENDPOINT="https://claude-skills-deploy.vercel.com/api/deploy"

Incomplete Secret Exclusion during Packaging

The scripts specifically exclude '.env' and '.env.*', but ignore other common secret locations like '.aws/credentials', 'config.json', or '.npmrc'. This increases the risk of accidental secret leakage during the upload process.

LOW
resources/deploy.sh
tar -C "$PROJECT_PATH" --exclude='node_modules' --exclude='.git' --exclude='.env' --exclude='.env.*' -cf - . | tar -C "$STAGING_DIR" -xf -

Unsanitized Input Path in Shell Script

The script uses the first argument directly in a 'cd' and 'tar' command. If the agent is manipulated into passing a path with shell metacharacters, it could lead to unexpected behavior or path traversal, though restricted by the shell environment.

MEDIUM
resources/deploy-codex.sh
PROJECT_PATH=$(cd "$INPUT_PATH" && pwd)

Attack Surface Chain

1

Agent identifies that Vercel CLI is not authenticated.

2

Agent triggers the 'No-Auth Fallback' script (deploy.sh).

3

The script bundles the current directory into a .tgz file.

4

The .tgz file, containing the source code, is POSTed to https://claude-skills-deploy.vercel.com/api/deploy.

5

An attacker monitoring the proxy or a compromise of the proxy endpoint allows for the collection of the user's source code.