sc-vercel — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sc-vercel (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Status: implemented (online path).
flowchart TD
A["/sc-vercel"] --> B["find/create Vercel project<br/>(bound to GitHub repo)"]
B --> C["set CONVEX_DEPLOY_KEY (encrypted)"]
C --> D["set coupled build cmd<br/>npx convex deploy --cmd 'npm run build'"]
D --> E["add custom domain / subdomain"]
E --> F["read required DNS from Vercel<br/>(array-normalized + IPv4 guard)"]
F --> G["Hostinger DNS<br/>CNAME (sub) / A (apex)"]
G --> H["trigger deploy + poll readyState<br/>(15-min cap, blip-tolerant)"]
H --> I["live URL ✅<br/>NEXT_PUBLIC_CONVEX_URL injected at build"]/sc-convex-cloud for the backend.scripts/deploy.js is a single 12-step orchestrator:
VERCEL_TOKEN (+ optional VERCEL_TEAM_ID).--git-owner/--git-repo, else read origin from the local git remote.findOrCreateProject({ name, gitRepo, framework:'nextjs' }) — bind the repo on create.CONVEX_DEPLOY_KEY (type:'encrypted', Production only — it's a prod key). Do not set NEXT_PUBLIC_CONVEX_URL (injected by the build).HOSTINGER_API_TOKEN.getDeployment every 4s until readyState ∈ {READY, ERROR, CANCELED}.misconfigured === false) up to ~60s — never hard-fail (cert/record can lag).| Var | Required | Purpose |
|---|---|---|
VERCEL_TOKEN | yes | Personal access token, https://vercel.com/account/tokens |
VERCEL_TEAM_ID | optional | For team-scoped projects; appended as ?teamId= to every API call |
CONVEX_DEPLOY_KEY | yes | Convex Cloud production deploy key. Set on Vercel as encrypted, Production-only. NEVER logged |
HOSTINGER_API_TOKEN | optional | Enables automatic DNS record writes. Without it, the records are printed for manual entry |
Set verbatim on the project so the Convex Cloud deploy runs before the Next.js build and injects the URL:
npx convex deploy --cmd 'npm run build' --cmd-url-env-var-name NEXT_PUBLIC_CONVEX_URLMandate: do NOT also hand-set NEXT_PUBLIC_CONVEX_URL in Vercel for the same env — the --cmd injection is the single source of truth. The --cmd-url-env-var-name NEXT_PUBLIC_CONVEX_URL override is required because Next.js only exposes NEXT_PUBLIC_-prefixed vars to the browser (the default injected CONVEX_URL never reaches the client).
Read live from Vercel's domain config; do not hardcode:
app.example.com) → CNAME to recommendedCNAME[0].value (fallback cname.vercel-dns.com).example.com) → A to the first IP of recommendedIPv4[rank=1].value (an array; pick value[0], fallback 76.76.21.21).verification[] when the domain reports verified:false — added first, then verifyDomain is called.CONVEX_DEPLOY_KEY is a secret: passed via env to the Vercel encrypted env, and never echoed by any script. Only NEXT_PUBLIC_CONVEX_URL (public) is printed.
node skills/sc-vercel/scripts/deploy.js \
--project myapp --app myapp --domain app.example.com \
--git-owner rahmanef63 --git-repo myapp --prod| Flag | Meaning |
|---|---|
--project <name> | Vercel project name (defaults to --app if omitted) |
--app <name> | Logical app name (defaults to --project) |
--domain <host> | Full host to attach — apex example.com OR subdomain app.example.com |
--git-owner <o> / --git-repo <r> | GitHub owner/name; if absent, read from git remote get-url origin |
--ref <branch> / --branch <branch> | Git ref/branch to deploy; if absent, derived from git rev-parse --abbrev-ref HEAD, else main (use this for master-default repos) |
--prod | Deploy the production target / alias |
--decoupled | Opt-out of coupled build: set NEXT_PUBLIC_CONVEX_URL from env instead of --cmd injection |
--cwd <path> | Working dir for git-remote resolution (default: process cwd) |
sc-vercel/
├── SKILL.md
└── scripts/
├── _shared.js # getClient (VERCEL_TOKEN/VERCEL_TEAM_ID) + parseArgs
└── deploy.js # 12-step orchestrator (project + env + build + domain + DNS + deploy)Note: the old "suggested file layout" with separateproject.js/env.js/domain.jsis superseded — project/env/domain/deploy are consolidated intodeploy.json top of thelib/vercel.jsclient.
https://api.vercel.com; auth Authorization: Bearer <VERCEL_TOKEN>; team projects append ?teamId=<VERCEL_TEAM_ID> to every URL.deploy.js cannot install it headlessly; a triggerDeploy 403 surfaces a clear hint to install the App./sc-all --target vercel skips the Dokploy app + self-hosted Convex; it uses /sc-convex-cloud + /sc-vercel instead.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.