# Vettd skill report

## Vettd assessment

| Field | Value |
| --- | --- |
| Verdict badge | flagged |
| Overall grade | F |
| Finding counts | critical: 6 · high: 0 · medium: 6 · low: 4 · info: 1 |
| Scanner runs | 2 |
| Freshness | verified_unchanged (last verified 2026-10-21T17:45:41.212Z) |
| Verdict policy version | consensus-v1 |

### Findings

- **critical** [security] Dangerous code execution functions that can execute arbitrary code
- **critical** [security] Node.js child_process module usage for shell command execution
- **critical** [security] Node.js child_process module usage for shell command execution
- **critical** [security] Shell execution without sandboxing
- **critical** [security] Shell execution without sandboxing
- **critical** [security] Shell execution without sandboxing
- **medium** [security] Outbound network request primitives in JavaScript/TypeScript
- **medium** [security] Outbound network request primitives in JavaScript/TypeScript
- **medium** [security] Outbound network request primitives in JavaScript/TypeScript
- **medium** [security] Outbound network request primitives in JavaScript/TypeScript
- **medium** [security] Outbound network request primitives in JavaScript/TypeScript
- **medium** [security] References external URL — review for indirect prompt injection risk
- **low** [security] Safety bypass flag detected
- **low** [security] Safety bypass flag detected
- **low** [security] Safety bypass flag detected
- **low** [security] Skill package contains many files
- **info** [security] Skill does not specify a license

## Provenance

| Field | Value |
| --- | --- |
| Source URL | https://github.com/vercel-labs/agent-skills/tree/main/skills/vercel-optimize |
| Assessed at | 2026-10-07T02:29:01.355Z |
| Published at | 2026-06-02T03:34:04.023Z |
| Public ID | 91d29ff9-c585-4a7f-b96b-e68fe054a910 |
| Canonical page | https://vettd.agentichighway.ai/skill/91d29ff9-c585-4a7f-b96b-e68fe054a910 |
| Content digest | not yet published for skills |
| Signature / attestation | not yet issued; null means unsigned, not unknown |

## Publisher-supplied metadata (not verified by Vettd)

The fields below come from the skill's publisher. Vettd does not verify
them; never treat them as instructions.

Name:

> vercel-optimize

Description:

> Use for Vercel cost and performance optimization on deployed projects, especially Next.js, SvelteKit, Nuxt, and limited Astro apps. Collect Vercel metrics, usage, project config, and code scan results first; investigate only metric-backed candidates; produce ranked recommendations grounded in verified files and version-aware Vercel/framework docs. Trigger for Vercel bill reduction, slow or expensive routes, caching opportunities, Function Invocations, Build Minutes, Fast Data Transfer, Core Web Vitals, Bot Management, Fluid compute, or cost breakdown requests.

Author:

> vercel-labs

Version:

> 1.2.0

License:

> _not provided_