Trust Assessment
vercel-deploy received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Data Exfiltration via Unofficial Deployment Endpoint.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on August 1, 2026 (commit 529b8103). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Data Exfiltration via Unofficial Deployment Endpoint The fallback deployment script `scripts/deploy.sh` packages the user's entire project directory (excluding only `.git` and `.env` files) and uploads it to an unofficial third-party endpoint (`https://deploy-skills.vercel.sh/api/deploy`). This endpoint is a custom Vercel deployment and not the official Vercel API (`api.vercel.com`), posing a significant risk of intellectual property theft and exposure of sensitive files or hardcoded credentials. Avoid using custom intermediary deployment endpoints. Use the official Vercel CLI (`vercel deploy`) or direct requests to the official Vercel API (`https://api.vercel.com`) with the user's own credentials. | LLM | scripts/deploy.sh:7 |
Scan History
Embed Code
[](https://skillshield.io/report/e417bf925a5bac84)
Powered by SkillShield