Vercel vercel-cli-with-tokens — agentic threat model

Not certain from the listing — the underlying foundation model is not specified. However, any model used is vulnerable to prompt injection attacks that could trick the agent into executing arbitrary Vercel CLI commands or leaking the active Vercel token.

Not certain from the listing — there is no explicit mention of RAG or vector databases. The primary data risk is the exposure of Vercel access tokens and project configuration files within the agent's context window.

The agent framework integrates directly with the Vercel CLI tool. The primary threat is insecure tool integration and tool misuse, where malicious or malformed inputs are passed directly to CLI execution blocks, potentially leading to command injection.

The agent executes CLI commands using a token for non-interactive authentication. If the execution environment is not strictly sandboxed, a compromised agent could leverage the CLI or local shell access to escalate privileges or exfiltrate the Vercel token from memory/disk.

Not certain from the listing — there are no mentioned logging, auditing, or guardrail mechanisms to monitor CLI commands before execution or to detect anomalous deployment behavior.

The agent handles highly sensitive credential surfaces (Vercel access tokens). There is a lack of visible identity and access management controls to restrict which users can trigger high-impact CLI commands (like project deletion or production deploys).

As an 'Agent Skill' designed to be integrated into broader agentic workflows, this tool introduces cascading risks. If a parent agent or a coordinating multi-agent system is compromised, this skill can be abused to deploy malicious code to production environments.