技能 vercel-deploy
📦
vercel-deploy
内容修订 r1 高风险 ⚡ 包含脚本⚙️ 外部命令🌐 网络访问🔑 环境变量
在 Vercel 上部署 Next.js 应用
当构建设置、域名和环境变量发生偏移时，Vercel 部署会失败。此技能可指导 Next.js 应用的配置、部署和故障排查。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "vercel-deploy" from https://skillstore.io/skills/awais68-vercel-deploy.md and its manifest at https://skillstore.io/api/skills/awais68-vercel-deploy/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“vercel-deploy”。 开发者请求帮助准备一个 Next.js 应用的首次生产部署。
预期结果:
一份分步部署检查清单，涵盖构建设置、公开变量、仅服务器端密钥、自定义域名设置和验证任务。
正在使用“vercel-deploy”。 团队报告 API 路由在本地可用，但部署后失败。
预期结果:
一份故障排查计划，用于检查重写目标、环境变量名称、部署日志、CORS 设置和后端可用性。
正在使用“vercel-deploy”。 发布经理希望获得更安全的 Vercel CI 部署指导。
预期结果:
一份 CI 部署审查，将预览发布和生产发布分开，验证令牌处理，并列出提升到生产环境前的审批点。
安全审计
高风险v8 • 2026/7/5 打开版本化报告
The skill is mostly deployment documentation, and most static hits are false positives from Markdown code fences, placeholders, and configuration examples. Confirmed risks remain around production Vercel commands, local environment pulls, package installs, and API proxy examples that can forward authorization data.
2
已扫描文件
641
分析行数
11
复核项
0
已忽略误报
已确认安全问题 (4)
高
Environment file access
vercel env pull .env.local
The command `vercel env pull .env.local` can write real project secrets into a local environment file. That is legitimate deployment work, but it needs explicit approval and careful handling.
高
Environment variant files
vercel env pull .env.local
This finding references the same environment pull command that writes Vercel values to `.env.local`. It can expose production or preview secrets in the workspace if handled carelessly.
中
Overly Permissive API CORS Header
The example sets Access-Control-Allow-Origin to `*` for API paths. Copying this into production can allow any origin to read API responses when other controls are weak.
The wildcard CORS header is explicitly present in the Vercel headers example. The risk depends on authentication and response sensitivity, so confidence is high but not absolute.
中
Authorization Header Forwarded to Configured Upstream
The Edge Function example forwards the incoming Authorization header to a URL built from NEXT_PUBLIC_API_URL. A wrong upstream value could receive user bearer tokens.
The code sample shows a fetch to an environment-derived endpoint and forwards Authorization. It is a legitimate proxy pattern, but host validation is not shown.
能力复核项 (11)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
中
Ruby/shell backtick execution
| Deploy | `vercel --prod` |
The quick reference includes `vercel --prod`, which can deploy to production if an agent runs it. This is expected for a deploy skill but still changes live infrastructure.
中
Ruby/shell backtick execution
```bash
This bash block tells the user or agent to install the Vercel CLI globally, log in, and link a project. Those are legitimate deployment steps, but they modify tooling and account-linked project state.
中
Ruby/shell backtick execution
```bash
This deployment command block includes preview deploys, production deploys, and pulling Vercel environment values into a local file. These commands are purposeful but can affect production and expose secrets locally.
中
Ruby/shell backtick execution
```bash
The CI example runs Vercel with a token and automatic confirmation. It is valid CI guidance, but misuse could deploy with sensitive credentials without an interactive approval step.
中
Ruby/shell backtick execution
```bash
The build block instructs running npm and Next.js build commands, which can execute project scripts. This is normal deployment behavior, but it is a real external-command execution path.
中
Ruby/shell backtick execution
```bash
The bundle analyzer section includes an npm install command for a development dependency. It is legitimate guidance, but it still fetches and installs third-party package code.
中
Ruby/shell backtick execution
- [ ] **Build succeeds locally**: `npm run build` completes without errors
The checklist explicitly asks for `npm run build`, which executes local package scripts. The command is expected for verification, but it remains an external command risk.
中
Ruby/shell backtick execution
```bash
The troubleshooting block tells the user to run `npm run build` locally. That is normal debugging guidance, but it can execute arbitrary project-defined build scripts.
中
Fetch API call
const response = await fetch(
The Edge Function example performs a network fetch to an environment-derived API URL and forwards request headers. This is a real outbound request pattern that can leak authorization data if the upstream is wrong.
中
Environment variable access (dot notation)
`${process.env.NEXT_PUBLIC_API_URL}/api/v1/endpoint`,
This example uses a public environment variable as the upstream URL for a server-side fetch. Combined with forwarded authorization headers, a misconfigured value could send tokens to the wrong host.
中
Environment variable object
`${process.env.NEXT_PUBLIC_API_URL}/api/v1/endpoint`,
This duplicate static finding points to the same server-side fetch URL built from a public environment variable. The risk is contextual because authorization headers are forwarded to that endpoint.
风险因素
⚡ 包含脚本 (1)
⚙️ 外部命令 (70)
SKILL.md:18 SKILL.md:20 SKILL.md:21 SKILL.md:26-38 SKILL.md:38-44 SKILL.md:44-55 SKILL.md:55-59 SKILL.md:59-126 SKILL.md:126-130 SKILL.md:130-188 SKILL.md:188-196 SKILL.md:196-201 SKILL.md:201-214 SKILL.md:214-218 SKILL.md:218-230 SKILL.md:230-234 SKILL.md:234-236 SKILL.md:236-241 SKILL.md:241-247 SKILL.md:247-257 SKILL.md:257-261 SKILL.md:261-273 SKILL.md:273-277 SKILL.md:277-281 SKILL.md:281-288 SKILL.md:288-293 SKILL.md:293-308 SKILL.md:308-312 SKILL.md:312-322 SKILL.md:322-328 SKILL.md:328-337 SKILL.md:337-341 SKILL.md:341-347 SKILL.md:347-351 SKILL.md:351-355 SKILL.md:355-361 SKILL.md:361-373 SKILL.md:373-379 SKILL.md:379-388 SKILL.md:388-392 SKILL.md:392-415 SKILL.md:415-419 SKILL.md:419-431 SKILL.md:431-437 SKILL.md:437-457 SKILL.md:457-461 SKILL.md:461-487 SKILL.md:487-491 SKILL.md:491-510 SKILL.md:510-514 SKILL.md:514-517 SKILL.md:517-527 SKILL.md:527-537 SKILL.md:537-539 SKILL.md:539-542 SKILL.md:542-544 SKILL.md:544-548 SKILL.md:548-550 SKILL.md:550 SKILL.md:551 SKILL.md:556-559 SKILL.md:559-562 SKILL.md:562-566 SKILL.md:566-567 SKILL.md:567-568 SKILL.md:568-574 SKILL.md:574-575 SKILL.md:575-576 SKILL.md:576-577 SKILL.md:577-578
🌐 网络访问 (12)
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/awais68-vercel-deploy/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/awais68-vercel-deploy?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/awais68-vercel-deploy?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/awais68-vercel-deploy/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/awais68-vercel-deploy.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
Awais68. (2026). vercel-deploy security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/awais68-vercel-deploy/audits/8BibTeX 引用
@techreport{awais68-awais68-vercel-deploy-2026,
author = {Awais68},
title = {vercel-deploy security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/awais68-vercel-deploy/audits/8},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "vercel-deploy security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
- name: "Awais68"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/awais68-vercel-deploy/audits/8"
identifiers:
- type: other
value: "skillstore:awais68-vercel-deploy:audit:8"
description: "Skillstore immutable audit report identifier"
比较变体
3 个可安装变体每位作者的技能都保持为独立的可安装项。推荐变体按 Skillstore 证据排序。
为什么此变体排名第一
Skillstore 使用量更高
作者 / 来源 Skillstore 评分 证据置信度 Skillstore 使用量 已更新
Skillstore 评分
评分依据 证据置信度: 中 45
架构
85
可维护性
87
内容
70
社区
78
规范符合性
你能构建什么
准备新的 Vercel 发布
为 Next.js 应用创建部署设置、环境变量指导和发布检查清单。
标准化部署配置
记录 Vercel 设置、自定义域名、重定向和缓存标头，以支持团队可重复部署。
排查失败的发布
在部署失败后审查构建错误、缺失的环境变量、域名记录和路由问题。
试试这些提示
创建部署检查清单
为我的 Next.js 应用创建一份 Vercel 部署检查清单。包括构建设置、环境变量、域名设置和最终验证步骤。
审查 Vercel 配置
审查我的 Vercel 和 Next.js 部署配置。识别缺失设置、有风险的默认值，以及生产环境上线前所需的更改。
规划 API 重写
为我的 Next.js 应用设计一个安全的 Vercel API 重写方案。包括上游 URL 处理、标头、CORS 和环境变量边界。
调试生产部署
帮助诊断我失败的 Vercel 生产部署。检查构建命令、框架设置、环境变量、重定向、域名和运行时错误。
最佳实践
- 在将更改提升到生产环境之前使用预览部署。
- 保持密钥仅限服务器端使用，并确认 .env.local 已被源代码控制忽略。
- 根据真实的生产架构验证域名、重定向和 API 重写。
避免
- 不要在未替换的情况下将占位符域名或令牌复制到生产环境。
- 不要使用 NEXT_PUBLIC 前缀暴露数据库 URL、API 密钥或服务令牌。
- 在确认目标 Vercel 项目之前，不要使用生产命令进行部署。
常见问题
此技能适用于哪些项目？
它适用于部署到 Vercel 的 Next.js 应用。
它能部署仅后端应用吗？
不能。它不是为仅后端服务或非 Vercel 托管而设计的。
它会处理环境变量吗？
是的。它解释公开变量、仅服务器端变量以及 Vercel 环境设置。
它能配置自定义域名吗？
可以。它包括 DNS 记录、重定向和 Vercel 域名设置指导。
它需要 Vercel CLI 访问权限吗？
某些工作流使用 Vercel CLI，但也描述了基于仪表板的设置。
生产命令应该自动运行吗？
不应该。生产部署和环境拉取应要求用户明确批准。
开发者详情
作者
Awais68许可证
MIT
Skillstore 修订
r1
版本提示
作者未声明版本。
引用
5ab1d37e83436c6eef84de88573e142b94f2a4ad
维护新鲜度
2026/7/18
使用量
9 次下载 · 221 次浏览