Shell execution without sandboxing
Vettd coreOWASP LLM06Detected in lib/vercel.mjs:1 — `// Vercel CLI helpers. All shell-outs use execFile (not exec) — no shell injection. Error detection: exit code + JSON-pa`
Public SkillFlagged
vercel-optimize
Use for Vercel cost and performance optimization on deployed projects, especially Next.js, SvelteKit, Nuxt, and limited Astro apps. Collect Vercel metrics, usage, project config, and code scan results first; investigate only metric-backed candidates; produce ranked recommendations grounded in verified files and version-aware Vercel/framework docs. Trigger for Vercel bill reduction, slow or expensive routes, caching opportunities, Function Invocations, Build Minutes, Fast Data Transfer, Core Web Vitals, Bot Management, Fluid compute, or cost breakdown requests.
Security Summary
This skill includes a SKILL.md descriptor and ships with reference documentation and scripts. Security observations: unsandboxed shell execution, a safety bypass flag, and references external URL.
Source
GitHub
Published
Jun 2, 2026
License
Not specified
Vettd Verdict
The overall verdict combines pass, warning, and failure signals across our checks. Click to see how each check is computed.F
Skill failed: 3 hard fails in security or structure checks.
- · Shell execution without sandboxing
- · Shell execution without sandboxing
- · Shell execution without sandboxing
- · Safety bypass flag detected
- · Safety bypass flag detected
- · Safety bypass flag detected
- · References external URL — review for indirect prompt injection risk
4
Critical
8
Medium
36
Info
Open Repo on GitHub →
Link points to the repository’s default branch (current HEAD). Certification reflects the state of the repo on Jun 2, 2026. Scanned at 4ec6f84b.
Dispute a finding?Sign in to file a dispute →