스킬 vercel-optimize

📦

vercel-optimize

Name: vercel-optimize
Author: vercel-labs

v1.2.0 콘텐츠 리비전 r1 높은 위험 ⚙️ 외부 명령어📁 파일 시스템 접근⚡ 스크립트 포함🌐 네트워크 접근🔑 환경 변수

Optimize Vercel Cost and Route Performance

Vercel costs and slow routes are difficult to prioritize without production evidence. This skill combines account metrics, scoped code checks, and verified documentation into ranked recommendations.

지원: Claude Codex Code(CC)

⚠️ 38 나쁨

Maintain this Skill? Claim it ⚠️ 38 나쁨

설치 전에 중지하고 확인을 요청하세요.

계획을 검토하고 파일을 변경하기 전에 사용자의 명시적 동의를 받으세요.

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "vercel-optimize" from https://skillstore.io/skills/vercel-labs-vercel-optimize.md and its manifest at https://skillstore.io/api/skills/vercel-labs-vercel-optimize/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/vercel-labs-vercel-optimize.md 서명된 manifest GET /api/skills/vercel-labs-vercel-optimize/manifest 서명된 lockfile GET /api/skills/vercel-labs-vercel-optimize/lockfile

테스트해 보기

"vercel-optimize" 사용 중입니다. A Next.js storefront has rising Vercel costs and slow product routes.

예상 결과:

Prioritize the product API because its traffic and 95th percentile duration dominate observed function usage.
Cache only the public success response, with a named freshness window and verified invalidation.
Keep authenticated and error responses dynamic.

"vercel-optimize" 사용 중입니다. A content site has poor cache efficiency and high data transfer.

예상 결과:

Rank high-traffic routes with low cache hit rates.
Identify oversized public assets and image delivery opportunities.
Separate verified recommendations from investigated items that need no change.

보안 감사

높은 위험

v1 • 2026. 8. 14. 버전별 보고서 열기

The 400 static alerts are lexical false positives from documentation, regular-expression APIs, relative imports, and constrained Vercel tooling. Two semantic issues remain: model-controlled verifier claims can escape the repository root and can supply unbounded regular expressions. The skill also intentionally reads project source and invokes the authenticated Vercel CLI, so users should review its access before running it. Static review was capped at 400/1603 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

156

스캔된 파일

19,169

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (2)

높음

lib/extract-claims.mjs:309-316 lib/verify-claim.mjs:1234-1243

Model-Controlled Claims Can Escape the Repository Root

Recommendation output can supply file and repoRoot values that become verifier claims. The path resolver accepts absolute paths and does not verify that normalized relative paths remain under the audited repository.

The data flow is direct: model-provided verifiableClaims retain an optional repoRoot, while repoPaths explicitly accepts absolute files and unchecked joined paths.

중간

lib/extract-claims.mjs:309-316 lib/verify-claim.mjs:90-103 lib/verify-claim.mjs:1206-1213

Unbounded Model-Supplied Regular Expressions

Recommendation output can add verifiable claims with arbitrary regular expressions. The verifier compiles and applies them to repository files without length, syntax, or complexity limits, enabling denial of service.

The verifier accepts model-provided claim objects, constructs RegExp instances from their patterns, and runs them against file content without resource controls.

위험 요인

⚙️ 외부 명령어 (50)

📁 파일 시스템 접근 (50)

⚡ 스크립트 포함 (39)

lib/dedup-recs.mjs:276 lib/gates/scanner-driven.mjs:118 lib/gates/select-candidates.mjs:120 lib/gates/select-candidates.mjs:130 lib/gates/uncached-route.mjs:9 lib/gates/uncached-route.mjs:21 lib/gates/uncached-route.mjs:22 lib/impact-label.mjs:109 lib/sanitizers/undeclared-dep.mjs:11 lib/sanitizers/undeclared-dep.mjs:74 lib/scanners/cache-components-suspense-dedupe.mjs:77 lib/scanners/cache-components-suspense-dedupe.mjs:85 lib/scanners/cache-components-suspense-dedupe.mjs:89 lib/scanners/edge-heavy-import.mjs:88 lib/scanners/edge-heavy-import.mjs:90 lib/scanners/edge-heavy-import.mjs:92 lib/scanners/force-dynamic.mjs:24 lib/scanners/headers-in-page.mjs:29 lib/scanners/max-age-without-s-maxage.mjs:29 lib/scanners/prisma-include-tree.mjs:29 lib/scanners/region-pin-in-config.mjs:48 lib/scanners/region-pin-in-config.mjs:65 lib/scanners/source-maps-production.mjs:24 lib/scanners/turbo-force-bypass.mjs:104 lib/scanners/unoptimized-image.mjs:34 lib/scanners/unoptimized-image.mjs:47 lib/scanners/unoptimized-image.mjs:66 lib/scanners/unoptimized-image.mjs:81 lib/scanners/use-cache-date-stamp.mjs:51 lib/scanners/use-cache-date-stamp.mjs:70 lib/vercel.mjs:87 lib/workspace-resolver.mjs:356 lib/workspace-resolver.mjs:360 lib/workspace-resolver.mjs:370 lib/workspace-resolver.mjs:380 lib/workspace-resolver.mjs:398 lib/workspace-resolver.mjs:476 lib/workspace-resolver.mjs:484 scripts/collect-sub-agent-outputs.mjs:196

🌐 네트워크 접근 (50)

lib/gates/cwv-poor.mjs:1 lib/gates/cwv-poor.mjs:10 lib/gates/isr-overrevalidation.mjs:9 lib/gates/middleware-heavy.mjs:8 lib/gates/route-errors.mjs:13 lib/grade-recommendation.mjs:6 lib/investigation-brief.mjs:605 lib/render-report.mjs:747 lib/sanitizers/rate-limit.mjs:5 lib/sanitizers/rate-limit.mjs:6 lib/sanitizers/rate-limit.mjs:7 lib/sanitizers/rate-limit.mjs:8 lib/scanners/cache-components-suspense-dedupe.mjs:65 lib/scanners/cache-components-suspense-dedupe.mjs:28 lib/scanners/cache-components-suspense-dedupe.mjs:29 lib/scanners/cache-components-suspense-dedupe.mjs:30 lib/scanners/edge-heavy-import.mjs:40 lib/scanners/edge-heavy-import.mjs:41 lib/scanners/force-dynamic.mjs:12 lib/scanners/headers-in-page.mjs:14 lib/scanners/headers-in-page.mjs:15 lib/scanners/large-static-asset.mjs:25 lib/scanners/large-static-asset.mjs:26 lib/scanners/max-age-without-s-maxage.mjs:14 lib/scanners/max-age-without-s-maxage.mjs:15 lib/scanners/middleware-broad-matcher.mjs:12 lib/scanners/missing-cache-headers.mjs:3 lib/scanners/missing-cache-headers.mjs:13 lib/scanners/missing-cache-headers.mjs:15 lib/scanners/missing-cache-headers.mjs:17 lib/scanners/missing-cache-headers.mjs:18 lib/scanners/missing-cache-headers.mjs:19 lib/scanners/region-pin-in-config.mjs:24 lib/scanners/region-pin-in-config.mjs:25 lib/scanners/source-maps-production.mjs:14 lib/scanners/sveltekit-prerender-missing.mjs:16 lib/scanners/sveltekit-prerender-missing.mjs:17 lib/scanners/sveltekit-prerender-missing.mjs:18 lib/scanners/turbo-force-bypass.mjs:25 lib/scanners/turbo-force-bypass.mjs:26 lib/scanners/turbo-force-bypass.mjs:27 lib/scanners/unoptimized-image.mjs:16 lib/scanners/unoptimized-image.mjs:17 lib/scanners/use-cache-date-stamp.mjs:24 lib/scanners/use-cache-date-stamp.mjs:25 metadata.json:7 metadata.json:8 metadata.json:9 metadata.json:10 metadata.json:11

🔑 환경 변수 (27)

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/vercel-labs-vercel-optimize/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/vercel-labs-vercel-optimize/security.svg)](https://skillstore.io/skills/vercel-labs-vercel-optimize?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/vercel-labs-vercel-optimize?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/vercel-labs-vercel-optimize/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/vercel-labs-vercel-optimize.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

vercel-labs. (2026). vercel-optimize security audit report (audit version 1) [Author version 1.2.0]. Skillstore. https://skillstore.io/skills/vercel-labs-vercel-optimize/audits/1

BibTeX 인용

@techreport{vercel-labs-vercel-labs-vercel-optimize-2026,
  author = {vercel-labs},
  title = {vercel-optimize security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/vercel-labs-vercel-optimize/audits/1},
  note = {Author version 1.2.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "vercel-optimize security audit report (audit version 1)"
version: "1.2.0"
type: report
authors:
  - name: "vercel-labs"
date-released: "2026-08-14"
url: "https://skillstore.io/skills/vercel-labs-vercel-optimize/audits/1"
identifiers:
  - type: other
    value: "skillstore:vercel-labs-vercel-optimize:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

100

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Reduce a growing Vercel bill

Identify the billing services, routes, and configurations responsible for observed spend, then rank actionable changes.

Diagnose slow production routes

Connect route latency, errors, cold starts, and external API delays to focused source investigations.

Prepare a platform optimization review

Assess caching, transfer, builds, bot traffic, and project settings before a capacity or architecture review.

이 프롬프트를 사용해 보세요

Run a basic audit

Audit this linked Vercel project. Collect production signals first, then report the highest-confidence cost and performance opportunities.

Investigate expensive routes

Investigate slow and expensive routes in this Vercel project. Rank findings by observed impact and cite the responsible files and applicable documentation.

Find safe caching opportunities

Find safe caching opportunities for public routes. Exclude authentication, errors, previews, webhooks, mutations, and user-specific responses unless evidence proves caching is safe.

Run an expanded verified audit

Run the full Vercel Optimize pipeline with a 12-candidate budget. Reconcile deep-dive evidence, verify every claim, and render the final report.

모범 사례

Run the skill from the intended linked project directory and confirm the Vercel account scope.
Collect production signals before inspecting route source files.
Review cache safety, framework version, and cited evidence before implementing recommendations.

피하기

Do not use the skill for projects that are not deployed on Vercel.
Do not infer route impact from code patterns without production traffic evidence.
Do not cache authenticated, error, preview, webhook, mutation, or user-specific responses without proof.