Vercel

Deploy and manage Vercel projects, including linking repositories, env vars, and domains.

This skill is instruction-only and appears coherent for managing Vercel projects. Before using it, ensure the agent environment has a trusted vercel CLI (or be aware that npx will download and run code from npm), and that you are comfortable with the agent running shell commands in your repository directories. The SKILL.md omits authentication details — you will likely need to be logged into Vercel or provide a VERCEL_TOKEN in the environment when running these commands. Avoid running these commands in environments containing untrusted or sensitive data unless you control the CLI binary and know which credentials will be used.

Type: OpenClaw Skill Name: vercel-deployment Version: 1.0.0 The skill bundle primarily uses standard `npx vercel` commands for project deployment and management. While the commands themselves are legitimate, the `SKILL.md` file contains instructions that require the AI agent to substitute user-provided values (e.g., `<project-root>`, `VAR_NAME`, `value`). This creates a significant prompt injection vulnerability, as an attacker could craft malicious inputs for these placeholders, potentially leading to shell injection or unauthorized actions if the agent does not properly sanitize or validate them before execution. There is no direct evidence of intentional malicious code or data exfiltration within the provided files, but the potential for exploitation via prompt injection makes it suspicious.