vercel-plugin-eval — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited vercel-plugin-eval (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Launch real Claude Code sessions with the plugin installed, monitor debug logs in real-time, and verify every hook fires correctly with proper dedup.
claude --print or -p — hooks don't fire, no files created--dangerously-skip-permissions/tmp/ — always use ~/dev/vercel-plugin-testing/settings.local.json — use npx add-pluginCLAUDE_PLUGIN_ROOT manuallybash -c in WezTerm — use /bin/zsh -icx aliasCopy the exact commands below. Do not improvise.
Always append a timestamp to directory names so reruns don't overwrite old projects:
# 1. Create test dir & install plugin (with timestamp)
TS=$(date +%Y%m%d-%H%M)
SLUG="my-eval-$TS"
mkdir -p ~/dev/vercel-plugin-testing/$SLUG
cd ~/dev/vercel-plugin-testing/$SLUG
npx add-plugin https://github.com/vercel/vercel-plugin -s project -y
# 2. Launch session via WezTerm
wezterm cli spawn --cwd /Users/johnlindquist/dev/vercel-plugin-testing/$SLUG -- /bin/zsh -ic \
"unset CLAUDECODE; VERCEL_PLUGIN_LOG_LEVEL=debug x '<PROMPT>' --settings .claude/settings.json; exec zsh"
# 3. Find debug log (wait ~25s for session start)
find ~/.claude/debug -name "*.txt" -mmin -2 -exec grep -l "$SLUG" {} +LOG=~/.claude/debug/<session-id>.txt
# SessionStart (3 hooks)
grep "SessionStart.*success" "$LOG"
# PreToolUse skill injection
grep -c "executePreToolHooks" "$LOG" # total calls
grep -c "provided additionalContext" "$LOG" # injections
# UserPromptSubmit
grep "UserPromptSubmit.*success" "$LOG"
# PostToolUse validate + shadcn font-fix
grep "posttooluse-validate.*provided" "$LOG"
grep "PostToolUse:Bash.*success" "$LOG"
# SessionEnd cleanup
grep "SessionEnd" "$LOG"TMPDIR=$(node -e "import {tmpdir} from 'os'; console.log(tmpdir())" --input-type=module)
CLAIMDIR="$TMPDIR/vercel-plugin-<session-id>-seen-skills.d"
# Claim files = one per skill, atomic O_EXCL
ls "$CLAIMDIR"
# Compare: injections should equal claims
inject_meta=$(grep -c "skillInjection:" "$LOG")
claims=$(ls "$CLAIMDIR" 2>/dev/null | wc -l | tr -d ' ')
echo "Injections: $((inject_meta / 3)) | Claims: $claims"skillInjection: appears 3x per actual injection in the debug log (initial check, parsed, success). Divide by 3.
Look for real catches — API key bypass, outdated models, wrong patterns:
grep "VALIDATION" "$LOG" | head -10Describe products and features, never name specific technologies. Let the plugin infer which skills to inject. Always end prompts with: "Link the project to my vercel-labs team so we can deploy it later. Skip any planning and just build it. Get the dev server running."
| Scenario Type | Skills Exercised |
|---|---|
| AI chat app | ai-sdk, ai-gateway, nextjs, ai-elements |
| Durable workflow | workflow, ai-sdk, vercel-queues |
| Monorepo | turborepo, turbopack, nextjs |
| Edge auth + routing | routing-middleware, auth, sign-in-with-vercel |
| Chat bot (multi-platform) | chat-sdk, ai-sdk, vercel-storage |
| Feature flags + CRM | vercel-flags, vercel-queues, ai-sdk |
| Email pipeline | email, satori, ai-sdk, vercel-storage |
| Marketplace/payments | payments, marketplace, cms |
| Kitchen sink | micro, ncc, all niche skills |
These need explicit technology references in the prompt because agents don't naturally reach for them:
ai-elements — say "use the AI Elements component registry"v0-dev — say "generate components with v0"vercel-firewall — say "use Vercel Firewall for rate limiting"marketplace — say "publish to the Vercel Marketplace"geist — say "install the geist font package"json-render — name files components/chat-*.tsxWrite results to .notes/COVERAGE.md with:
rm -rf ~/dev/vercel-plugin-testing~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.