📦

vercel

Name: vercel
Author: Dicklesworthstone

Content revision r1 High Risk ⚙️ External commands

Manage Vercel Projects from Your AI Agent

Vercel work often requires switching between deployment, domain, environment, and team commands. This skill gives Claude, Codex, and Claude Code a focused CLI reference for common Vercel operations.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "vercel" from https://skillstore.io/skills/dicklesworthstone-vercel.md and its manifest at https://skillstore.io/api/skills/dicklesworthstone-vercel/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/dicklesworthstone-vercel.md Signed manifest GET /api/skills/dicklesworthstone-vercel/manifest Signed lockfile GET /api/skills/dicklesworthstone-vercel/lockfile

Test it

Using "vercel". I need to check recent Vercel deployments for this project.

Expected outcome:

The assistant would suggest listing recent deployments, selecting the correct deployment, and inspecting details before reviewing logs.

Using "vercel". I want to update a Vercel environment variable.

Expected outcome:

The assistant would confirm the project, team, environment, and variable name before suggesting add or remove steps.

Using "vercel". I am ready to deploy this app to production.

Expected outcome:

The assistant would verify branch, project, team, environment variables, and domain status before recommending the production deployment command.

Security Audit

High Risk

v8 • 7/5/2026 Open versioned report

The skill is a Vercel CLI command reference, and many static backtick hits are Markdown or read-only command false positives. Real risks remain for commands that deploy, mutate cloud resources, run local project code, or pull environment variables into local files. No prompt injection text was found in SKILL.md.

Files scanned

147

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

SKILL.md:88

Environment file access

Pull env vars to local .env file:

The cited text explicitly instructs pulling Vercel environment variables into a local .env file. That can place secrets on disk and create disclosure risk if the file is mishandled.

High

SKILL.md:17-20 SKILL.md:54-56 SKILL.md:66-68 SKILL.md:93-95 SKILL.md:126-128

Production and Destructive Vercel Operations Lack Approval Guidance

SKILL.md includes production deployment, project removal, domain addition, environment removal, and team switching commands without explicit confirmation guidance. These actions can affect live services or account resources if executed in the wrong context.

The cited command examples directly perform production, destructive, or context-changing Vercel actions. The file provides no approval or target-verification workflow around them.

Medium

SKILL.md:100-102 SKILL.md:110-112

Local Project Code Execution Through Vercel Commands

The skill recommends local dev and build commands that can execute the current project code and dependencies. The file does not warn users to inspect the workspace before running those commands.

The commands are legitimate Vercel workflows, but dev and build operations commonly run project code in the local environment. This risk is contextual and not fully captured by the generic external command pattern.

Capability review items (14)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:18-20

Ruby/shell backtick execution

```bash

The fenced example runs a production deployment with the Vercel CLI. A production deploy can change a live service and should require explicit target and release confirmation.

High

SKILL.md:55-57

Ruby/shell backtick execution

```bash

The fenced example removes a Vercel project by name. This is a destructive cloud operation and can delete or disable an intended project if an agent uses the wrong identifier.

High

SKILL.md:67-69

Ruby/shell backtick execution

```bash

The fenced example adds a domain to a Vercel project, changing routing for a real domain and project. Domain attachment mistakes can affect production traffic or ownership assumptions.

High

SKILL.md:89-91

Ruby/shell backtick execution

```bash

The fenced example pulls Vercel environment variables into the local workspace. This can materialize secrets in local files and increases the chance of accidental disclosure.

High

SKILL.md:94-96

Ruby/shell backtick execution

```bash

The fenced example removes an environment variable from a Vercel project. Removing configuration or secrets can break deployments and should require explicit confirmation.

Medium

SKILL.md:13-15

Ruby/shell backtick execution

```bash

The fenced example runs the Vercel CLI to deploy the current directory, which can publish local code and project assets to a cloud account. The command is hardcoded, but deployment is a real account-changing action.

Medium

SKILL.md:33-35

Ruby/shell backtick execution

```bash

The fenced example retrieves Vercel deployment logs, which can contain sensitive application data or operational details. The command is legitimate but can expose private project information.

Medium

SKILL.md:38-40

Ruby/shell backtick execution

```bash

The fenced example redeploys a previous Vercel deployment. Redeploying mutates cloud state and can affect the public application if executed against the wrong target.

Medium

SKILL.md:50-52

Ruby/shell backtick execution

```bash

The fenced example links the local directory to a Vercel project, changing local project association and deployment target. That context change can route later deploys to the wrong account resource.

Medium

SKILL.md:84-86

Ruby/shell backtick execution

```bash

The fenced example adds an environment variable to a Vercel project. Environment changes can alter runtime behavior and may introduce or overwrite sensitive configuration.

Medium

SKILL.md:101-103

Ruby/shell backtick execution

```bash

The fenced example starts the Vercel local development server. Running the dev server can execute project code and expose a local service in the current workspace.

Medium

SKILL.md:106-108

Ruby/shell backtick execution

```bash

The fenced example pulls Vercel project settings into the local workspace. This changes local project metadata and can expose account-specific configuration.

Medium

SKILL.md:111-113

Ruby/shell backtick execution

```bash

The fenced example runs a local Vercel build, which can execute project build scripts and dependencies. This is expected for development but remains local code execution.

Medium

SKILL.md:127-129

Ruby/shell backtick execution

```bash

The fenced example switches the active Vercel team context. Changing team context can cause later commands to operate against the wrong account or organization.

Risk Factors

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/dicklesworthstone-vercel/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/dicklesworthstone-vercel/security.svg)](https://skillstore.io/skills/dicklesworthstone-vercel?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/dicklesworthstone-vercel?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dicklesworthstone-vercel/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/dicklesworthstone-vercel.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Dicklesworthstone. (2026). vercel security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/dicklesworthstone-vercel/audits/8

BibTeX citation

@techreport{dicklesworthstone-dicklesworthstone-vercel-2026,
  author = {Dicklesworthstone},
  title = {vercel security audit report (audit version 8)},
  institution = {Skillstore},
  year = {2026},
  number = {8},
  url = {https://skillstore.io/skills/dicklesworthstone-vercel/audits/8},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "vercel security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
  - name: "Dicklesworthstone"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/dicklesworthstone-vercel/audits/8"
identifiers:
  - type: other
    value: "skillstore:dicklesworthstone-vercel:audit:8"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Deploy a Web Project

Prepare preview or production deployment steps for a Vercel-hosted web application.

Review Deployment Health

Inspect a deployment, check recent deployments, and review logs during incident response.

Manage Project Configuration

Find commands for domains, environment variables, teams, and project links.

Try These Prompts

Find a Deployment Command

Show me the Vercel CLI steps to deploy this project as a preview deployment. Explain when I should use production instead.

Inspect a Failed Deployment

Help me inspect a failed Vercel deployment. Ask for the deployment URL, then suggest the safest commands to check status and logs.

Prepare Local Development

Prepare a safe sequence to link this repository to Vercel, pull project settings, and run local development. Include preflight checks.

Plan a Production Release

Plan a production Vercel release workflow that covers team context, environment variables, domain checks, deployment, log review, and rollback.

Best Practices

Confirm the active Vercel project, team, and environment before write operations.
Treat pulled environment files as secrets and keep them out of version control.
Ask for explicit approval before production deploys, project removal, domain changes, or environment removal.

Avoid

Running production deploys without checking branch, project, and team context.
Pulling environment variables into a shared workspace without secret handling.
Removing projects, domains, or environment variables based on ambiguous names.

Frequently Asked Questions

What does this skill help with?

It provides Vercel CLI command guidance for deployments, projects, domains, environment variables, teams, and authentication.

Does it deploy automatically?

No. It documents CLI workflows. Any command execution depends on the host tool and user approval settings.

Does it require the Vercel CLI?

Yes. The workflows assume the Vercel CLI is installed and authenticated in the working environment.

Can it manage environment variables?

It includes commands to list, add, pull, and remove environment variables. Handle pulled values as secrets.

Does it use the Vercel REST API?

No. The skill focuses on Vercel CLI commands, not API requests or SDK usage.

Is it safe for production use?

Use it with explicit approval steps. Verify team, project, branch, domains, and environment variables before production changes.

Developer Details

Author

Dicklesworthstone

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/Dicklesworthstone/agent_flywheel_clawdbot_skills_and_integrations/tree/main/skills/vercel

Ref

c579efd02184f1128d6741d16e6c8d951d7d4208

Maintenance freshness

7/18/2026

Usage

5 downloads · 274 views

File structure

📄 SKILL.md