Skills vercel-deploy
📦

vercel-deploy

v1.0.0 Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Deploy Projects to Vercel

Publishing a project for review often requires setup and account steps. This skill packages a local project, detects its framework, and returns Vercel preview and claim links.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "vercel-deploy" from https://skillstore.io/skills/zhanlincui-vercel-deploy.md and its manifest at https://skillstore.io/api/skills/zhanlincui-vercel-deploy/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/zhanlincui-vercel-deploy.md Signed manifest GET /api/skills/zhanlincui-vercel-deploy/manifest Signed lockfile GET /api/skills/zhanlincui-vercel-deploy/lockfile

Test it

Using "vercel-deploy". Deploy the current directory to Vercel.

Expected outcome:

The deployment succeeds and the response lists a preview link, a claim link, and deployment identifiers.

Using "vercel-deploy". Deploy my static HTML demo.

Expected outcome:

The skill prepares the static project, creates a Vercel preview, and explains how to claim the deployment.

Using "vercel-deploy". Deploy the project after checking what will be uploaded.

Expected outcome:

The assistant reports upload risks first, then runs deployment only after explicit user approval.

Security Audit

High Risk
v5 • 7/8/2026 Open versioned report

The skill performs real shell-based deployment and uploads a project archive to a hardcoded external endpoint. Most markdown backtick and example URL findings are false positives, but the network upload and local source mutation require user consent and remediation.

2
Files scanned
363
Lines analyzed
3
Review items
0
False positives ignored

Confirmed security concerns (2)

High
scripts/deploy.sh:208-222
Project Archive Upload to External Endpoint
The script creates a tarball of the selected project and uploads it to a remote deployment endpoint. The archive excludes node_modules and .git, but it can still include source code, secrets, and private configuration.
The tar command packages the project and the curl command posts that archive to the deployment endpoint. The behavior is direct and intentional.
Medium
scripts/deploy.sh:191-204
Source Directory Modified During Static HTML Deployment
For static HTML projects, the script renames a single root HTML file to index.html inside the original project directory. This can unexpectedly change user files during deployment.
The mv command operates on HTML_FILE and PROJECT_PATH in the source directory. The code does not stage a copy before renaming.
Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
scripts/deploy.sh:222
Shell command substitution
RESPONSE=$(curl -s -X POST "$DEPLOY_ENDPOINT" -F "file=@$TARBALL" -F "framework=$FRAMEWORK")
The curl command posts the generated tarball to a hardcoded external deployment service. This intentionally sends project contents outside the local environment.
High
scripts/deploy.sh:9
Hardcoded URL
DEPLOY_ENDPOINT="https://claude-skills-deploy.vercel.com/api/deploy"
The hardcoded endpoint is later used to receive the project archive through curl. This is expected deployment behavior, but it is still an external data transfer risk.
Medium
scripts/deploy.sh:1
Unix shell invocation
#!/bin/bash
The skill includes a bash script that packages files, mutates project content, and performs a network upload. Shell execution is central to the skill and remains a real operational risk.

Risk Factors

⚙️ External commands (32)
scripts/deploy.sh:20 scripts/deploy.sh:162 scripts/deploy.sh:186 scripts/deploy.sh:189 scripts/deploy.sh:194 scripts/deploy.sh:195 scripts/deploy.sh:199 scripts/deploy.sh:200 scripts/deploy.sh:222 scripts/deploy.sh:226 scripts/deploy.sh:232 scripts/deploy.sh:233 scripts/deploy.sh:1 SKILL.md:15 SKILL.md:16 SKILL.md:22-24 SKILL.md:24-27 SKILL.md:27 SKILL.md:31-40 SKILL.md:40-44 SKILL.md:44-53 SKILL.md:53-57 SKILL.md:57-64 SKILL.md:64-68 SKILL.md:68-78 SKILL.md:78 SKILL.md:82-83 SKILL.md:83 SKILL.md:84-90 SKILL.md:90-98 SKILL.md:98-106 SKILL.md:106-112
🌐 Network access (8)
scripts/deploy.sh:9 SKILL.md:51 SKILL.md:52 SKILL.md:59 SKILL.md:60 SKILL.md:93 SKILL.md:94 SKILL.md:109
📁 Filesystem access (1)
scripts/deploy.sh:162
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/zhanlincui-vercel-deploy/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/zhanlincui-vercel-deploy/security.svg)](https://skillstore.io/skills/zhanlincui-vercel-deploy?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/zhanlincui-vercel-deploy?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/zhanlincui-vercel-deploy/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/zhanlincui-vercel-deploy.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

ZhanlinCui. (2026). vercel-deploy security audit report (audit version 5) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/zhanlincui-vercel-deploy/audits/5

BibTeX citation

@techreport{zhanlincui-zhanlincui-vercel-deploy-2026, author = {ZhanlinCui}, title = {vercel-deploy security audit report (audit version 5)}, institution = {Skillstore}, year = {2026}, number = {5}, url = {https://skillstore.io/skills/zhanlincui-vercel-deploy/audits/5}, note = {Author version 1.0.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "vercel-deploy security audit report (audit version 5)" version: "1.0.0" type: report authors: - name: "ZhanlinCui" date-released: "2026-07-08" url: "https://skillstore.io/skills/zhanlincui-vercel-deploy/audits/5" identifiers: - type: other value: "skillstore:zhanlincui-vercel-deploy:audit:5" description: "Skillstore immutable audit report identifier"

Compare variants

3 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Higher Skillstore usage
ZhanlinCui Recommended Current

zhanlincui-vercel-deploy

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 44
Updated

2026-08-21

supercent-io

supercent-io-vercel-deploy

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 17
Updated

2026-08-21

Awais68

awais68-vercel-deploy

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 13
Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium
45
Architecture
100
Maintainability
85
Content
71
Community
83
Spec Compliance

What You Can Build

Share a Preview Build

Deploy a local web project and send a preview link to reviewers.

Publish a Static Demo

Package a small HTML project and make it available through Vercel.

Test Framework Deployment

Check whether a project can be packaged and deployed with the detected framework setting.

Try These Prompts

Deploy Current Project 
Deploy the current project to Vercel and show me the preview and claim links.
Deploy Specific Folder 
Deploy the app in ./web to Vercel. Confirm what will be uploaded before running the deployment script.
Deploy Existing Archive 
Deploy ./release/project.tgz to Vercel and summarize the deployment result in plain language.
Review and Deploy Safely 
Inspect the project for private files, explain deployment risks, then deploy to Vercel only after I approve the upload.

Best Practices

  • Review the project for secrets before uploading it to the deployment endpoint.
  • Use a temporary copy when deploying static HTML projects that need filename changes.
  • Share both the preview link and claim link with clear ownership instructions.

Avoid

  • Do not deploy private repositories without explicit approval from the project owner.
  • Do not upload directories that contain .env files, credentials, or customer data.
  • Do not treat preview deployment as proof that production configuration is correct.

Frequently Asked Questions

Does this skill require a Vercel account?
The script creates a preview deployment without local account authentication and returns a claim link.
What files are uploaded?
The script archives the selected project directory, excluding node_modules and .git by default.
Can it deploy a static HTML project?
Yes. It can handle projects without package.json and may rename a single HTML file to index.html.
How does framework detection work?
It reads package.json and matches dependency names for common frontend and backend frameworks.
What network access is required?
The script must reach the deployment endpoint and Vercel claim or preview domains.
What should users check before deployment?
Users should remove secrets, private data, and files that should not leave the workspace.

Developer Details

Author

ZhanlinCui

License

MIT

Author version

v1.0.0

Skillstore revision

r1

Repository

https://github.com/ZhanlinCui/Ultimate-Agent-Skills-Collection/tree/main/vercel-deploy

Ref

88a205c7f635a966e31156313b590d59007c5caa

Maintenance freshness

7/18/2026

Usage

41 downloads · 234 views

File structure

📁 scripts/

📄 deploy.sh

📄 SKILL.md

More from ZhanlinCui

View all

Related Skills

View all