vercel-agent-skills

Name: vercel-agent-skills
Author: vercel-labs

✓ Vetted

Vercel's first-party skills for React, Next, and deploys. Carefully built; one deploy skill uploads your source to a public Vercel preview, so know that before you run it.

Installed, run, and audited by hand on Jul 16, 2026.

by vercel-labs skill Front-endWeb development

Last shipped 5 days ago passing liveness · checked Jul 28, 2026

Commit activity · last 52 weeks

Stars30k

LanguageJavaScript

Open issues163

Pricingfree

ListedJul 12, 2026

Facts pulled from the source repo and refreshed nightly. Stars are a data point, not our ranking. We don't order by popularity.

Install npx skills add vercel-labs/agent-skills

Runs in

Harness	Support	Notes
Claude Code	full	—

Support levels reflect what we actually ran, not what the README claims. untested means exactly that.

The verdict

Vercel's own skills for React, Next, and deploys, and they are built with care: about 850 always-on tokens across nine skills, token values redacted from output, shell calls made through execFile rather than a shell string, and no telemetry. One skill needs a clear-eyed look before you use it. deploy-to-vercel tars your whole project and POSTs it to a Vercel endpoint (claude-skills-deploy.vercel.com) with no auth, producing a preview URL anyone can claim. It excludes node_modules, .git, and .env files first, and the skill asks before pushing, so it is a disclosed design, not a leak. Know that your source leaves your machine when you run it. The rest (react-best-practices, composition-patterns, view-transitions, web-design-guidelines) are read-and-advise skills with no such surface.

What it is

Nine first-party skills from Vercel: React best practices, composition patterns, view transitions, React Native, a design-and-writing review pair, cost optimization, and two deploy helpers. Installs through the shared skills CLI.

How it was vetted

Read the repo at commit f8a72b9 (2026-06-10), ran the injection audit, and read the deploy scripts line by line.

About 850 always-on tokens across nine skills. Descriptions are specific and quoted-phrase based, so they fire on real intent.
Deploy uploads your source. deploy-to-vercel/resources/deploy.sh builds a tarball and POSTs it to claude-skills-deploy.vercel.com/api/deploy, then polls a public preview URL. It excludes node_modules, .git, .env, and .env.* (deploy.sh:202-205), and the skill is told to ask first. The catch: the deploy is unauthenticated and the preview is publicly claimable.
Careful with credentials elsewhere. vercel-optimize redacts VERCEL_TOKEN, NPM_TOKEN, GITHUB_TOKEN, and others from its output and shells out through execFile, not a shell string. vercel-cli-with-tokens warns against passing tokens as flags, to keep them out of shell history.
No telemetry, no injection, no hidden instructions. MIT.

Runs in

What it is

How it was vetted

More in Front-end