Skills vercel-cli-with-tokens
📦
vercel-cli-with-tokens
Low Risk ⚙️
External commands🌐
Network access📁
Filesystem access🔑
Env variables
Deploy to Vercel with token authentication
Deploying web applications to Vercel requires authentication and project configuration. This skill enables your AI assistant to manage Vercel deployments using access tokens, without interactive login prompts.
Supports: Claude Codex Code(CC)
1
Download the skill ZIP
2
Upload in Claude
Go to Settings → Capabilities → Skills → Upload skill
3
Toggle on and start using
Test it
Using "vercel-cli-with-tokens". Deploy this project to Vercel as a preview
Expected outcome:
- Found VERCEL_TOKEN in environment
- Linked project via git remote to team: my-team
- Deploying to Vercel (preview)...
- Deployment URL: https://my-project-abc123.vercel.app
Using "vercel-cli-with-tokens". Add DATABASE_URL to production environment on Vercel
Expected outcome:
- Adding DATABASE_URL to production environment...
- Environment variable added successfully
- Available in: production
Security Audit
Low Riskv1 • 4/16/2026
All static analysis findings are false positives. The scanner detected shell command patterns in markdown documentation (backtick code blocks) rather than actual executable code. The skill is legitimate Vercel CLI documentation from vercel-labs that instructs the AI agent on deployment workflows. The skill follows security best practices, including warnings against passing tokens via command-line flags. Environment variable access and external commands are inherent to the tool's purpose and used safely.
1
Files scanned
329
Lines analyzed
8
findings
1
Total audits
Low Risk Issues (4)
Static analyzer false positives on shell commands in markdown
The static scanner flagged 123 instances of shell command patterns (backtick execution, command substitution, template literals) in SKILL.md. These are all markdown code blocks documenting Vercel CLI usage, not executable code. Examples include vercel deploy, git add, npm install, and grep commands in documentation.
Static analyzer false positives on environment variable access
The scanner flagged 11 instances of environment file access (.env reads, VERCEL_TOKEN, VERCEL_PROJECT_ID, VERCEL_ORG_ID). This is expected behavior for a deployment tool that reads project configuration. The skill explicitly warns against exposing tokens in command-line arguments.
Static analyzer false positives on network URLs
The scanner flagged 3 hardcoded URLs (vercel.com/account/tokens, vercel.com/my-team/my-project). These are official Vercel documentation and account URLs, not suspicious external endpoints.
Static analyzer false positives on filesystem access
The scanner flagged 7 instances of file access (.env, .vercel/project.json, .vercel/repo.json, git remote). These are standard files for Vercel project configuration and git repository metadata.
Risk Factors
⚙️ External commands (123)
SKILL.md:11 SKILL.md:17 SKILL.md:19-21 SKILL.md:21-25 SKILL.md:25 SKILL.md:25-27 SKILL.md:27-29 SKILL.md:29-33 SKILL.md:33-35 SKILL.md:35-37 SKILL.md:37-39 SKILL.md:39-41 SKILL.md:41-43 SKILL.md:43-45 SKILL.md:45-47 SKILL.md:47-49 SKILL.md:49-57 SKILL.md:57 SKILL.md:57-59 SKILL.md:59-66 SKILL.md:66-70 SKILL.md:70-72 SKILL.md:72-79 SKILL.md:79-81 SKILL.md:81-83 SKILL.md:83-86 SKILL.md:86-88 SKILL.md:88 SKILL.md:88 SKILL.md:88-90 SKILL.md:90-93 SKILL.md:93-95 SKILL.md:95 SKILL.md:95-101 SKILL.md:101-104 SKILL.md:104-112 SKILL.md:112 SKILL.md:112-114 SKILL.md:114-116 SKILL.md:116-118 SKILL.md:118 SKILL.md:118-120 SKILL.md:120-122 SKILL.md:122-126 SKILL.md:126-128 SKILL.md:128-132 SKILL.md:132-134 SKILL.md:134-142 SKILL.md:142-148 SKILL.md:148-154 SKILL.md:154-156 SKILL.md:156-158 SKILL.md:158 SKILL.md:158-162 SKILL.md:162-164 SKILL.md:164-166 SKILL.md:166-170 SKILL.md:170-172 SKILL.md:172-174 SKILL.md:174 SKILL.md:174 SKILL.md:174-184 SKILL.md:184-188 SKILL.md:188-191 SKILL.md:191-194 SKILL.md:194-195 SKILL.md:195-199 SKILL.md:199-201 SKILL.md:201-205 SKILL.md:205-207 SKILL.md:207-212 SKILL.md:212-215 SKILL.md:215-217 SKILL.md:217-219 SKILL.md:219-222 SKILL.md:222-225 SKILL.md:225 SKILL.md:225 SKILL.md:225 SKILL.md:225-226 SKILL.md:226 SKILL.md:226 SKILL.md:226 SKILL.md:226 SKILL.md:226-228 SKILL.md:228 SKILL.md:228-230 SKILL.md:230 SKILL.md:230 SKILL.md:230 SKILL.md:230-234 SKILL.md:234-249 SKILL.md:249-253 SKILL.md:253-262 SKILL.md:262-266 SKILL.md:266-272 SKILL.md:272-276 SKILL.md:276 SKILL.md:276-277 SKILL.md:277-280 SKILL.md:280-282 SKILL.md:282-283 SKILL.md:283-289 SKILL.md:289-291 SKILL.md:291-294 SKILL.md:294-298 SKILL.md:298-300 SKILL.md:300 SKILL.md:300-307 SKILL.md:307-309 SKILL.md:309-315 SKILL.md:315-317 SKILL.md:317-320 SKILL.md:320-321 SKILL.md:321-322 SKILL.md:322 SKILL.md:322 SKILL.md:322-326 SKILL.md:326-328 SKILL.md:34 SKILL.md:48 SKILL.md:33-35 SKILL.md:47-49
🌐 Network access (3)
📁 Filesystem access (7)
Audited by: claude
Quality Score
38
Architecture
100
Maintainability
85
Content
50
Community
82
Security
91
Spec Compliance
What You Can Build
Automated preview deployments for development teams
Development teams can use this skill to deploy preview versions of their applications on every branch. The AI assistant handles token authentication, project linking, and deployment without requiring manual login.
CI/CD pipeline integration for production deployments
Teams running CI/CD pipelines need non-interactive authentication to Vercel. This skill manages token-based deployments and environment variable configuration for automated release workflows.
Quick project setup for freelance and solo developers
Independent developers can deploy client projects to Vercel without configuring interactive login sessions. The skill finds existing tokens in .env files and handles project linking automatically.
Try These Prompts
Deploy current project to Vercel
Deploy this project to Vercel as a preview. Check for an existing token in the environment or .env file first.
Set up Vercel for a new project
I need to deploy this project to Vercel. Help me find or set up the token, link the project to the right team, and do a preview deployment.
Manage environment variables on Vercel
Add the following environment variables to my Vercel project for the production environment. Use the token already configured. Variables: DATABASE_URL, API_KEY, NEXT_PUBLIC_APP_URL.
Deploy to production with custom domain
Deploy this project to production on Vercel and add the custom domain example.com to it. Make sure the token is set and the project is linked to the correct team scope.
Best Practices
- Always export VERCEL_TOKEN as an environment variable rather than passing it as a --token flag to avoid exposing secrets in shell history
- Default to preview deployments and only deploy to production when explicitly requested by the user
- Always ask for user approval before pushing commits to git, as the skill supports git-based deployments
Avoid
- Never pass VERCEL_TOKEN as a --token command-line argument, as it exposes the secret in shell history and process listings
- Do not read or modify .vercel/ directory files directly, as the Vercel CLI manages this directory and direct manipulation can cause inconsistent state
- Do not run vercel ls or vercel link in unlinked directories, as they may prompt interactively or link as an unintended side-effect
Frequently Asked Questions
Where does the skill find my Vercel token?
The skill checks the VERCEL_TOKEN environment variable first, then looks in your .env file. If no token is found, it will ask you to provide one. You can create a token at vercel.com/account/tokens.
How does the skill avoid exposing my token in shell history?
The skill exports VERCEL_TOKEN as an environment variable and relies on the Vercel CLI to read it from the environment. It never passes the token as a --token flag, which would expose it in shell history and process listings.
Can I deploy to production with this skill?
Yes, but the skill defaults to preview deployments. Production deployment requires your explicit request. Use the --prod flag or ask for a production deployment directly.
What is the difference between vercel link and vercel link --repo?
vercel link --repo uses your git remote to find and connect to the matching Vercel project, which is more reliable. Plain vercel link matches by directory name and may connect to the wrong project.
Do I need VERCEL_PROJECT_ID and VERCEL_ORG_ID to deploy?
Not always. If you use vercel link, the project ID is stored in .vercel/project.json. Setting both VERCEL_PROJECT_ID and VERCEL_ORG_ID in the environment skips the linking step entirely and lets the CLI target the project directly.
How do I manage environment variables for different Vercel environments?
Use vercel env add VAR_NAME to set a variable for all environments, or vercel env add VAR_NAME production (or preview, development) to target a specific environment. Use vercel env ls to list all configured variables.