Is deploy-to-vercel safe?
Grade B, 84/100. Minor issues.
Deploy applications and websites to Vercel. Use when the user requests deployment actions like "deploy my app", "deploy and give me the link", "push this live", or "create a preview deployment".
Bdeploy-to-vercel
skills/deploy-to-vercel84/100 · Minor issues3 medium1 low
deploy-to-vercel
skills/deploy-to-vercelDeploy applications and websites to Vercel. Use when the user requests deployment actions like "deploy my app", "deploy and give me the link", "push this live", or "create a preview deployment".
- Content hash
- sha256:9c3044e6db7ce0fd615914f22e58065aabd2d6c934d9392151087f7981a8bd8e
- Files
- 4
- Quality
- 100/100
Security findings
- mediumBundled archiveSL708 · skills/deploy-to-vercel/Archive.zip:1
Archive.zipAn archive inside the skill hides its contents from review and from this scan. Fix: Commit the extracted files instead of the archive.
- mediumUploads data to a remote hostSL203 · skills/deploy-to-vercel/resources/deploy-codex.sh:239
RESPONSE=$(curl -s -X POST "$DEPLOY_ENDPOINT" -F "file=@$TARBALL" -F "framework=$FRAMEWORK")The skill sends data to a network endpoint. Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host.
- mediumUploads data to a remote hostSL203 · skills/deploy-to-vercel/resources/deploy.sh:239
RESPONSE=$(curl -s -X POST "$DEPLOY_ENDPOINT" -F "file=@$TARBALL" -F "framework=$FRAMEWORK")The skill sends data to a network endpoint. Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host.
- lowUnpinned package installSL501 · skills/deploy-to-vercel/SKILL.md:141
npm install -g vercelInstalling without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).
Files in this skill
- Archive.zip11.0 KB
- SKILL.md11.5 KB
- resources/deploy-codex.sh8.6 KB
- resources/deploy.sh8.6 KB
Questions about deploy-to-vercel
- Is deploy-to-vercel safe to install?
- Our scanner gave deploy-to-vercel grade B (84/100): minor issues. It matched 4 rule(s); review them below before installing. Static analysis cannot prove safety, so pin the reviewed revision with a lockfile.
- How do I install deploy-to-vercel in Claude Code or Codex?
- Run skillhash add github:vercel-labs/agent-skills/skills/deploy-to-vercel. It downloads the exact commit, checks the grade against your policy, writes skills.lock and installs it into .claude/skills and .agents/skills.
- What happens if deploy-to-vercel changes upstream?
- Its content hash changes. skillhash verify fails in CI until you review the new version and update the lock. With a watch, you also get an alert.
More from vercel-labs/agent-skills
- A
vercel-composition-patterns
33kvercel-labs/agent-skills
React composition patterns that scale. Use when refactoring components with boolean prop proliferation, building flexible component libraries, or designing reusable APIs. Triggers on tasks involving compound components, render props, context providers, or component architecture. Includes React 19 API changes.
No security findings - A
vercel-react-best-practices
33kvercel-labs/agent-skills
React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.
No security findings - A
vercel-react-native-skills
33kvercel-labs/agent-skills
React Native and Expo best practices for building performant mobile apps. Use when building React Native components, optimizing list performance, implementing animations, or working with native modules. Triggers on tasks involving React Native, Expo, mobile performance, or native platform APIs.
No security findings - A
vercel-react-view-transitions
33kvercel-labs/agent-skills
Guide for implementing smooth, native-feeling animations using React's View Transition API (`<ViewTransition>` component, `addTransitionType`, and CSS view transition pseudo-elements). Use this skill whenever the user wants to add page transitions, animate route changes, create shared element animations, animate enter/exit of components, animate list reorder, implement directional (forward/back) navigation animations, or integrate view transitions in Next.js. Also use when the user mentions view transitions, `startViewTransition`, `ViewTransition`, transition types, or asks about animating between UI states in React without third-party animation libraries.
No security findings - A
writing-guidelines
33kvercel-labs/agent-skills
Review docs/prose for Writing Guidelines compliance. Use when asked to "review my docs", "check writing style", "audit prose", "review docs voice and tone", or "check this page against the writing handbook".
No security findings - A
vercel-optimize
33kvercel-labs/agent-skills
Use for Vercel cost and performance optimization on deployed projects, especially Next.js, SvelteKit, Nuxt, and limited Astro apps. Collect Vercel metrics, usage, project config, and code scan results first; investigate only metric-backed candidates; produce ranked recommendations grounded in verified files and version-aware Vercel/framework docs. Trigger for Vercel bill reduction, slow or expensive routes, caching opportunities, Function Invocations, Build Minutes, Fast Data Transfer, Core Web Vitals, Bot Management, Fluid compute, or cost breakdown requests.
No security findings - A
web-design-guidelines
33kvercel-labs/agent-skills
Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "check accessibility", "audit design", "review UX", or "check my site against best practices".
No security findings - B
vercel-cli-with-tokens
33kvercel-labs/agent-skills
Deploy and manage projects on Vercel using token-based authentication. Use when working with Vercel CLI using access tokens rather than interactive login — e.g. "deploy to vercel", "set up vercel", "add environment variables to vercel".
4 medium2 low