deploy-to-vercel — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited deploy-to-vercel (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Deploy any project to Vercel. Always deploy as preview (not production) unless the user explicitly asks for production.
The goal is to get the user into the best long-term setup: their project linked to Vercel with git-push deploys. Every method below tries to move the user closer to that state.
Run all four checks before deciding which method to use:
# 1. Check for a git remote
git remote get-url origin 2>/dev/null
# 2. Check if locally linked to a Vercel project (either file means linked)
cat .vercel/project.json 2>/dev/null || cat .vercel/repo.json 2>/dev/null
# 3. Check if the Vercel CLI is installed and authenticated
vercel whoami 2>/dev/null
# 4. List available teams (if authenticated)
vercel teams list --format json 2>/dev/nullIf the user belongs to multiple teams, present all available team slugs as a bulleted list and ask which one to deploy to. Once the user picks a team, proceed immediately to the next step — do not ask for additional confirmation.
Pass the team slug via --scope on all subsequent CLI commands (vercel deploy, vercel link, vercel inspect, etc.):
vercel deploy [path] -y --no-wait --scope <team-slug>If the project is already linked (.vercel/project.json or .vercel/repo.json exists), the orgId in those files determines the team — no need to ask again. If there is only one team (or just a personal account), skip the prompt and use it directly.
About the `.vercel/` directory: A linked project has either:
.vercel/project.json — created by vercel link (single project linking). Contains projectId and orgId..vercel/repo.json — created by vercel link --repo (repo-based linking). Contains orgId, remoteName, and a projects array mapping directories to Vercel project IDs.Either file means the project is linked. Check for both.
Do NOT use vercel project inspect, vercel ls, or vercel link to detect state in an unlinked directory — without a .vercel/ config, they will interactively prompt (or with --yes, silently link as a side-effect). Only vercel whoami is safe to run anywhere.
.vercel/ exists) + has git remote → Git PushThis is the ideal state. The project is linked and has git integration.
This project is connected to Vercel via git. I can commit and push to
trigger a deployment. Want me to proceed? git add .
git commit -m "deploy: <description of changes>"
git pushVercel automatically builds from the push. Non-production branches get preview deployments; the production branch (usually main) gets a production deployment.
sleep 5
vercel ls --format jsonThe JSON output has a deployments array. Find the latest entry — its url field is the preview URL.
If the CLI is not authenticated, tell the user to check the Vercel dashboard or the commit status checks on their git provider for the preview URL.
.vercel/ exists) + no git remote → vercel deployThe project is linked but there's no git repo. Deploy directly with the CLI.
vercel deploy [path] -y --no-waitUse --no-wait so the CLI returns immediately with the deployment URL instead of blocking until the build finishes (builds can take a while). Then check on the deployment status with:
vercel inspect <deployment-url>For production deploys (only if user explicitly asks):
vercel deploy [path] --prod -y --no-waitThe CLI is working but the project isn't linked yet. This is the opportunity to get the user into the best state.
Linking this project to <team name> on Vercel. This will create a Vercel
project to deploy to and enable automatic deployments on future git pushes. vercel link --repo --scope <team-slug>This reads the git remote URL and matches it to existing Vercel projects that deploy from that repo. It creates .vercel/repo.json. This is much more
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.