技能 vercel-optimize

📦

vercel-optimize

Name: vercel-optimize
Author: vercel-labs

v1.2.0 內容修訂 r1 高風險 ⚙️ 外部命令📁 檔案系統存取⚡ 包含腳本🌐 網路存取🔑 環境變數

Optimize Vercel Cost and Route Performance

Vercel costs and slow routes are difficult to prioritize without production evidence. This skill combines account metrics, scoped code checks, and verified documentation into ranked recommendations.

支援: Claude Codex Code(CC)

⚠️ 38 差

Maintain this Skill? Claim it ⚠️ 38 差

安裝前請停止並請求確認。

請審查安裝計畫，並在變更檔案前取得使用者明確同意。

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "vercel-optimize" from https://skillstore.io/skills/vercel-labs-vercel-optimize.md and its manifest at https://skillstore.io/api/skills/vercel-labs-vercel-optimize/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/vercel-labs-vercel-optimize.md 已簽名 manifest GET /api/skills/vercel-labs-vercel-optimize/manifest 已簽名 lockfile GET /api/skills/vercel-labs-vercel-optimize/lockfile

測試它

正在使用「vercel-optimize」。 A Next.js storefront has rising Vercel costs and slow product routes.

預期結果:

Prioritize the product API because its traffic and 95th percentile duration dominate observed function usage.
Cache only the public success response, with a named freshness window and verified invalidation.
Keep authenticated and error responses dynamic.

正在使用「vercel-optimize」。 A content site has poor cache efficiency and high data transfer.

預期結果:

Rank high-traffic routes with low cache hit rates.
Identify oversized public assets and image delivery opportunities.
Separate verified recommendations from investigated items that need no change.

安全審計

高風險

v1 • 2026/8/14 開啟版本化報告

The 400 static alerts are lexical false positives from documentation, regular-expression APIs, relative imports, and constrained Vercel tooling. Two semantic issues remain: model-controlled verifier claims can escape the repository root and can supply unbounded regular expressions. The skill also intentionally reads project source and invokes the authenticated Vercel CLI, so users should review its access before running it. Static review was capped at 400/1603 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

156

已掃描檔案

19,169

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (2)

高

lib/extract-claims.mjs:309-316 lib/verify-claim.mjs:1234-1243

Model-Controlled Claims Can Escape the Repository Root

Recommendation output can supply file and repoRoot values that become verifier claims. The path resolver accepts absolute paths and does not verify that normalized relative paths remain under the audited repository.

The data flow is direct: model-provided verifiableClaims retain an optional repoRoot, while repoPaths explicitly accepts absolute files and unchecked joined paths.

中

lib/extract-claims.mjs:309-316 lib/verify-claim.mjs:90-103 lib/verify-claim.mjs:1206-1213

Unbounded Model-Supplied Regular Expressions

Recommendation output can add verifiable claims with arbitrary regular expressions. The verifier compiles and applies them to repository files without length, syntax, or complexity limits, enabling denial of service.

The verifier accepts model-provided claim objects, constructs RegExp instances from their patterns, and runs them against file content without resource controls.

風險因素

⚙️ 外部命令 (50)

📁 檔案系統存取 (50)

⚡ 包含腳本 (39)

lib/dedup-recs.mjs:276 lib/gates/scanner-driven.mjs:118 lib/gates/select-candidates.mjs:120 lib/gates/select-candidates.mjs:130 lib/gates/uncached-route.mjs:9 lib/gates/uncached-route.mjs:21 lib/gates/uncached-route.mjs:22 lib/impact-label.mjs:109 lib/sanitizers/undeclared-dep.mjs:11 lib/sanitizers/undeclared-dep.mjs:74 lib/scanners/cache-components-suspense-dedupe.mjs:77 lib/scanners/cache-components-suspense-dedupe.mjs:85 lib/scanners/cache-components-suspense-dedupe.mjs:89 lib/scanners/edge-heavy-import.mjs:88 lib/scanners/edge-heavy-import.mjs:90 lib/scanners/edge-heavy-import.mjs:92 lib/scanners/force-dynamic.mjs:24 lib/scanners/headers-in-page.mjs:29 lib/scanners/max-age-without-s-maxage.mjs:29 lib/scanners/prisma-include-tree.mjs:29 lib/scanners/region-pin-in-config.mjs:48 lib/scanners/region-pin-in-config.mjs:65 lib/scanners/source-maps-production.mjs:24 lib/scanners/turbo-force-bypass.mjs:104 lib/scanners/unoptimized-image.mjs:34 lib/scanners/unoptimized-image.mjs:47 lib/scanners/unoptimized-image.mjs:66 lib/scanners/unoptimized-image.mjs:81 lib/scanners/use-cache-date-stamp.mjs:51 lib/scanners/use-cache-date-stamp.mjs:70 lib/vercel.mjs:87 lib/workspace-resolver.mjs:356 lib/workspace-resolver.mjs:360 lib/workspace-resolver.mjs:370 lib/workspace-resolver.mjs:380 lib/workspace-resolver.mjs:398 lib/workspace-resolver.mjs:476 lib/workspace-resolver.mjs:484 scripts/collect-sub-agent-outputs.mjs:196

🌐 網路存取 (50)

lib/gates/cwv-poor.mjs:1 lib/gates/cwv-poor.mjs:10 lib/gates/isr-overrevalidation.mjs:9 lib/gates/middleware-heavy.mjs:8 lib/gates/route-errors.mjs:13 lib/grade-recommendation.mjs:6 lib/investigation-brief.mjs:605 lib/render-report.mjs:747 lib/sanitizers/rate-limit.mjs:5 lib/sanitizers/rate-limit.mjs:6 lib/sanitizers/rate-limit.mjs:7 lib/sanitizers/rate-limit.mjs:8 lib/scanners/cache-components-suspense-dedupe.mjs:65 lib/scanners/cache-components-suspense-dedupe.mjs:28 lib/scanners/cache-components-suspense-dedupe.mjs:29 lib/scanners/cache-components-suspense-dedupe.mjs:30 lib/scanners/edge-heavy-import.mjs:40 lib/scanners/edge-heavy-import.mjs:41 lib/scanners/force-dynamic.mjs:12 lib/scanners/headers-in-page.mjs:14 lib/scanners/headers-in-page.mjs:15 lib/scanners/large-static-asset.mjs:25 lib/scanners/large-static-asset.mjs:26 lib/scanners/max-age-without-s-maxage.mjs:14 lib/scanners/max-age-without-s-maxage.mjs:15 lib/scanners/middleware-broad-matcher.mjs:12 lib/scanners/missing-cache-headers.mjs:3 lib/scanners/missing-cache-headers.mjs:13 lib/scanners/missing-cache-headers.mjs:15 lib/scanners/missing-cache-headers.mjs:17 lib/scanners/missing-cache-headers.mjs:18 lib/scanners/missing-cache-headers.mjs:19 lib/scanners/region-pin-in-config.mjs:24 lib/scanners/region-pin-in-config.mjs:25 lib/scanners/source-maps-production.mjs:14 lib/scanners/sveltekit-prerender-missing.mjs:16 lib/scanners/sveltekit-prerender-missing.mjs:17 lib/scanners/sveltekit-prerender-missing.mjs:18 lib/scanners/turbo-force-bypass.mjs:25 lib/scanners/turbo-force-bypass.mjs:26 lib/scanners/turbo-force-bypass.mjs:27 lib/scanners/unoptimized-image.mjs:16 lib/scanners/unoptimized-image.mjs:17 lib/scanners/use-cache-date-stamp.mjs:24 lib/scanners/use-cache-date-stamp.mjs:25 metadata.json:7 metadata.json:8 metadata.json:9 metadata.json:10 metadata.json:11

🔑 環境變數 (27)

審計單位: codex

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/vercel-labs-vercel-optimize/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/vercel-labs-vercel-optimize/security.svg)](https://skillstore.io/skills/vercel-labs-vercel-optimize?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/vercel-labs-vercel-optimize?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/vercel-labs-vercel-optimize/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/vercel-labs-vercel-optimize.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

vercel-labs. (2026). vercel-optimize security audit report (audit version 1) [Author version 1.2.0]. Skillstore. https://skillstore.io/skills/vercel-labs-vercel-optimize/audits/1

BibTeX 引用

@techreport{vercel-labs-vercel-labs-vercel-optimize-2026,
  author = {vercel-labs},
  title = {vercel-optimize security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/vercel-labs-vercel-optimize/audits/1},
  note = {Author version 1.2.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "vercel-optimize security audit report (audit version 1)"
version: "1.2.0"
type: report
authors:
  - name: "vercel-labs"
date-released: "2026-08-14"
url: "https://skillstore.io/skills/vercel-labs-vercel-optimize/audits/1"
identifiers:
  - type: other
    value: "skillstore:vercel-labs-vercel-optimize:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

100

可維護性

內容

社群

規範符合度

你可以打造什麼

Reduce a growing Vercel bill

Identify the billing services, routes, and configurations responsible for observed spend, then rank actionable changes.

Diagnose slow production routes

Connect route latency, errors, cold starts, and external API delays to focused source investigations.

Prepare a platform optimization review

Assess caching, transfer, builds, bot traffic, and project settings before a capacity or architecture review.

試試這些提示

Run a basic audit

Audit this linked Vercel project. Collect production signals first, then report the highest-confidence cost and performance opportunities.

Investigate expensive routes

Investigate slow and expensive routes in this Vercel project. Rank findings by observed impact and cite the responsible files and applicable documentation.

Find safe caching opportunities

Find safe caching opportunities for public routes. Exclude authentication, errors, previews, webhooks, mutations, and user-specific responses unless evidence proves caching is safe.

Run an expanded verified audit

Run the full Vercel Optimize pipeline with a 12-candidate budget. Reconcile deep-dive evidence, verify every claim, and render the final report.

最佳實務

Run the skill from the intended linked project directory and confirm the Vercel account scope.
Collect production signals before inspecting route source files.
Review cache safety, framework version, and cited evidence before implementing recommendations.

避免

Do not use the skill for projects that are not deployed on Vercel.
Do not infer route impact from code patterns without production traffic evidence.
Do not cache authenticated, error, preview, webhook, mutation, or user-specific responses without proof.