Skill scan report

vercel-deploy

View on GitHub

35 Medium This skill sends sensitive values to an external host. Automated analysis flagged 1 additional risk pattern.

What this skill does

Deployment automation for Vercel

github/openai - Data Exfiltration - 24.7k stars

ThreatsData Exfiltration Insecure Script Execution

Threat analysis

Data Exfiltration1 finding

Insecure Script Execution1 finding

Skill info

Nameopenai/vercel-deploy

Registrygithub

Version49f948f

PURLpkg:github/openai/skills@49f948f?skill=vercel-deploy

Stars24.7k

SourceView on GitHub

Assessments (2)

Data Exfiltration1 finding HIGH

HIGH

Data Exfiltration via local-llm-review

scripts/deploy.sh

The script sends deployment data to an external endpoint: 'https://codex-deploy-skills.vercel.sh/api/deploy'. This could be used to exfiltrate deployment metadata or other sensitive information if not

Insecure Script Execution1 finding MEDIUM

MEDIUM

Insecure Script Execution via local-llm-review

scripts/deploy.sh

The script is executed directly from the file system without any validation of the input path. This could allow for path traversal or execution of arbitrary scripts if the input is not properly saniti

Badge

Add the Anomity scan badge for vercel-deploy to your README.

Markdown

[![Anomity Skill Check](https://anomity.ai/skills/badge.svg)](https://anomity.ai/skills/github/openai/vercel-deploy/)

HTML

<a href="https://anomity.ai/skills/github/openai/vercel-deploy/"><img src="https://anomity.ai/skills/badge.svg" alt="Anomity Skill Check"></a>

Image URL

https://anomity.ai/skills/badge.svg

How Anomity governs this at runtime

Scan-time vetting tells you what a skill says it will do. Anomity's Endpoint Sensor sees what agents actually do: it discovers skills alongside every other AI artifact on the endpoint, and runtime governance can allow, deny, or log the tool calls a skill triggers. Policy violations route to your SIEM, Slack, email, or Jira, backed by a queryable 90-day audit trail.

Book a 30-minute demo to see your own skill inventory.

Methodology and disputes

Every skill is assessed by the Anomity Skill Intelligence engine against its public source; findings indicate risk patterns, not confirmed exploitation. Maintainer of vercel-deploy? Report an issue or request a rescan.