{"id":"cmuxjx6f91braad07rwefzcjd","slug":"vercel-optimize","publicId":"82b07bf5-6c49-4472-8085-6c0c1ee32c8d","name":"vercel-optimize","description":"Use for Vercel cost and performance optimization on deployed projects, especially Next.js, SvelteKit, Nuxt, and limited Astro apps. Collect Vercel metrics, usage, project config, and code scan results first; investigate only metric-backed candidates; produce ranked recommendations grounded in verified files and version-aware Vercel/framework docs. Trigger for Vercel bill reduction, slow or expensive routes, caching opportunities, Function Invocations, Build Minutes, Fast Data Transfer, Core Web Vitals, Bot Management, Fluid compute, or cost breakdown requests.","version":"1.2.0","author":"vercel-labs","license":"","compatibility":"","status":"completed","overallGrade":"F","scannerVersion":11,"fileCount":156,"hasSkillMd":true,"hasScripts":true,"hasReferences":true,"hasEvals":false,"hasAssets":false,"sourceType":"github","sourceUrl":"https://github.com/vercel-labs/agent-skills/tree/main/skills/vercel-optimize","createdAt":"2026-10-07T03:32:04.667Z","completedAt":"2026-10-07T03:32:04.663Z","visibility":"public","publishedAt":"2026-08-03T22:21:05.460Z","category":"","frameworks":[],"badgeStatus":"flagged","downloadCount":0,"verdictRationale":{"summary":"Skill failed: 3 hard fails in security or structure checks.","verdict":"fail","scanners":[{"source":"vettd","weight":1,"verdict":"fail"},{"source":"cisco","weight":0.8,"verdict":"fail"}],"consensus":"fail","warnTriggers":["Safety bypass flag detected","Safety bypass flag detected","Safety bypass flag detected","References external URL — review for indirect prompt injection risk"],"policyVersion":"consensus-v1","hardFailTriggers":["Shell execution without sandboxing","Shell execution without sandboxing","Shell execution without sandboxing"]},"verdictPolicyVersion":"consensus-v1","skillId":"cmsdsmq7e03qfad066qfxeo1h","findings":[{"id":"cmuxjx6fa1brqad07k0etau75","source":"cisco","category":"security","label":"Dangerous code execution functions that can execute arbitrary code","detail":"lib/vercel.mjs:87 — Pattern detected: exec(","severity":"critical","ruleId":"COMMAND_INJECTION_EVAL","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"f31559195b912256077a1326fe340b9d","filepath":"lib/vercel.mjs"},{"id":"cmuxjx6fa1brpad07exjfr6ra","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"lib/vercel.mjs:3 — Pattern detected: from 'node:child_process'","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"ef55099ee42c99a0d8252f29ba6ead1e","filepath":"lib/vercel.mjs"},{"id":"cmuxjx6fa1brrad07ansol4qd","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"lib/verify-claim.mjs:4 — Pattern detected: from 'node:child_process'","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"6f451c95a2da487ce3e6352163a93300","filepath":"lib/verify-claim.mjs"},{"id":"cmuxjx6fa1brbad070lh9m820","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in lib/sanitizers/undeclared-dep.mjs:10 — `'dns', 'tls', 'util', 'url', 'stream', 'buffer', 'events', 'process', 'child_process',`","severity":"critical","ruleId":"VTD-0018","owaspLlmCategory":null,"intent":"negligent","chainId":null,"fingerprint":"616b2d8ee674248ee05e2552aa2a05f8","filepath":"lib/sanitizers/undeclared-dep.mjs"},{"id":"cmuxjx6fa1brdad07xacf3w5e","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in lib/vercel.mjs:1 — `// Vercel CLI helpers. All shell-outs use execFile (not exec) — no shell injection. Error detection: exit code + JSON-pa`","severity":"critical","ruleId":"VTD-0018","owaspLlmCategory":null,"intent":"negligent","chainId":null,"fingerprint":"49e9d5f7b5e8e2b907fe6427682d6e8e","filepath":"lib/vercel.mjs"},{"id":"cmuxjx6fa1bread07o9e55wii","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in lib/verify-claim.mjs:4 — `import { execFile } from 'node:child_process';`","severity":"critical","ruleId":"VTD-0018","owaspLlmCategory":null,"intent":"negligent","chainId":null,"fingerprint":"eb4df9b1665fb8096b3e085897842842","filepath":"lib/verify-claim.mjs"},{"id":"cmuxjx6fa1brkad07li979qtg","source":"cisco","category":"security","label":"Outbound network request primitives in JavaScript/TypeScript","detail":"lib/grade-recommendation.mjs:6 — Pattern detected: fetch(","severity":"medium","ruleId":"DATA_EXFIL_JS_NETWORK","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"c001a089b11a86e905e4194e75f601af","filepath":"lib/grade-recommendation.mjs"},{"id":"cmuxjx6fa1brlad07kpj9qk6r","source":"cisco","category":"security","label":"Outbound network request primitives in JavaScript/TypeScript","detail":"lib/investigation-brief.mjs:605 — Pattern detected: fetch(","severity":"medium","ruleId":"DATA_EXFIL_JS_NETWORK","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"7a42454183affe4f20d72e697003982f","filepath":"lib/investigation-brief.mjs"},{"id":"cmuxjx6fa1brmad07lkpdzn2f","source":"cisco","category":"security","label":"Outbound network request primitives in JavaScript/TypeScript","detail":"lib/scanners/cache-components-suspense-dedupe.mjs:65 — Pattern detected: fetch(","severity":"medium","ruleId":"DATA_EXFIL_JS_NETWORK","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"a3d13cfe72c87815ed1d9bd74ad09ce1","filepath":"lib/scanners/cache-components-suspense-dedupe.mjs"},{"id":"cmuxjx6fa1brnad07vce1eby0","source":"cisco","category":"security","label":"Outbound network request primitives in JavaScript/TypeScript","detail":"lib/scanners/missing-cache-headers.mjs:13 — Pattern detected: fetch(","severity":"medium","ruleId":"DATA_EXFIL_JS_NETWORK","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"8a5510e109dc5a4cec67d5ec7cc38456","filepath":"lib/scanners/missing-cache-headers.mjs"},{"id":"cmuxjx6fa1broad077u3cti9e","source":"cisco","category":"security","label":"Outbound network request primitives in JavaScript/TypeScript","detail":"lib/scanners/missing-cache-headers.mjs:15 — Pattern detected: fetch(","severity":"medium","ruleId":"DATA_EXFIL_JS_NETWORK","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"8a5510e109dc5a4cec67d5ec7cc38456","filepath":"lib/scanners/missing-cache-headers.mjs"},{"id":"cmuxjx6fa1brhad077eylokk1","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in references/candidates.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"fab60ef867ca39e6242e4d9260d63c63","filepath":"references/candidates.md"},{"id":"cmuxjx6fa1brcad078kaehjau","source":"vettd","category":"security","label":"Safety bypass flag detected","detail":"Detected in lib/scanners/turbo-force-bypass.mjs:5 — `//   force-flag      — `TURBO_FORCE=true` env var or `turbo run ... --force` in build script`","severity":"low","ruleId":"VTD-0028","owaspLlmCategory":null,"intent":"negligent","chainId":null,"fingerprint":"59452d6442fa3334d8069973a4503136","filepath":"lib/scanners/turbo-force-bypass.mjs"},{"id":"cmuxjx6fa1brfad075h7yrk5y","source":"vettd","category":"security","label":"Safety bypass flag detected","detail":"Detected in scripts/merge-signals.mjs:18 — `console.error('usage: node scripts/merge-signals.mjs <signals.json> <codebase.json> [--out merged.json] [--force]');`","severity":"low","ruleId":"VTD-0028","owaspLlmCategory":null,"intent":"negligent","chainId":null,"fingerprint":"ba0c799f7dab6eaf7d71b461a0cc7b2f","filepath":"scripts/merge-signals.mjs"},{"id":"cmuxjx6fa1brgad07rusruy7d","source":"vettd","category":"security","label":"Safety bypass flag detected","detail":"Detected in scripts/prepare-investigation-brief.mjs:208 — `else if (a === '--force') out.force = true;`","severity":"low","ruleId":"VTD-0028","owaspLlmCategory":null,"intent":"negligent","chainId":null,"fingerprint":"2673abc7af221f2efa6179c917a995cb","filepath":"scripts/prepare-investigation-brief.mjs"},{"id":"cmuxjx6fa1briad073taejhaj","source":"cisco","category":"security","label":"Skill package contains many files","detail":". — Skill package contains 156 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.","severity":"low","ruleId":"EXCESSIVE_FILE_COUNT","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"0e5dbe855e5da49272840d5db00e1a2c","filepath":"."},{"id":"cmuxjx6fa1brjad07obem3hco","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"592f7ac7731768f0fd0bba83f30850f9","filepath":"SKILL.md"}],"scannerRuns":[{"source":"cisco","status":"success","verdict":null,"grade":"F","findingCount":10,"criticalCount":3,"highCount":3},{"source":"vettd","status":"success","verdict":null,"grade":"F","findingCount":7,"criticalCount":3,"highCount":3}],"user":{"name":"Kris Mondlane","image":"https://avatars.githubusercontent.com/u/237055?v=4"},"repository":{"owner":"vercel-labs","name":"agent-skills"},"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-22T02:57:39.529Z","lastVerifiedAt":"2026-10-22T02:57:39.529Z","lastChangeDetectedAt":"2026-09-10T21:08:46.889Z","scannedHash":"0901aa3667db7a6e5cc40b213327290bf6556373","latestUpstreamHash":"0901aa3667db7a6e5cc40b213327290bf6556373","nextCheckDueAt":"2026-10-23T04:52:44.222Z"},"signalCategories":[{"category":"safety","label":"Safety","form":"graded","verdict":null,"rows":[]},{"category":"reliability","label":"Reliability & Quality","form":"graded","verdict":null,"rows":[]},{"category":"performance","label":"Performance","form":"measured","verdict":{"form":"measured","magnitudes":[{"ruleId":"performance/static-context-tokens","label":"Static context tokens","value":3842,"unit":null,"method":"tiktoken/cl100k_base/skill-md-body"}]},"rows":[{"origin":"signal","id":"cmuxjx83v1c29ad07jjkkk1v3","subjectType":"skill_audit","subjectId":"cmuxjx6f91braad07rwefzcjd","relatedType":"","relatedId":"","dataCategory":"performance","sourceClass":"scan","source":"vettd","ruleId":"performance/progressive-disclosure","severity":null,"label":"Progressive disclosure","detail":null,"valueNum":null,"valueText":"present","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T03:31:54.000Z","payload":null},{"origin":"signal","id":"cmuxjx6t01btxad07tijl7cb4","subjectType":"skill_audit","subjectId":"cmuxjx6f91braad07rwefzcjd","relatedType":"","relatedId":"","dataCategory":"performance","sourceClass":"scan","source":"vettd","ruleId":"performance/static-context-tokens","severity":null,"label":"Static context tokens","detail":null,"valueNum":3842,"valueText":null,"unit":null,"method":"tiktoken/cl100k_base/skill-md-body","derivation":null,"confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T03:31:54.000Z","payload":null}]},{"category":"cost","label":"Cost","form":"measured","verdict":null,"rows":[]},{"category":"compatibility","label":"Compatibility","form":"unjudged","verdict":{"form":"unjudged"},"rows":[{"origin":"signal","id":"cmuxjx86i1c2wad07eyu9jtve","subjectType":"skill_audit","subjectId":"cmuxjx6f91braad07rwefzcjd","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/cli-help","severity":null,"label":"CLI help","detail":null,"valueNum":null,"valueText":"present","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T03:31:54.000Z","payload":null},{"origin":"signal","id":"cmuxjx6vs1budad07hpdv568m","subjectType":"skill_audit","subjectId":"cmuxjx6f91braad07rwefzcjd","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/declared-environment-assumptions","severity":null,"label":"Declared environment assumptions","detail":null,"valueNum":null,"valueText":"","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T03:31:54.000Z","payload":null},{"origin":"signal","id":"cmuxjx7bz1bxead07t1gsit0s","subjectType":"skill_audit","subjectId":"cmuxjx6f91braad07rwefzcjd","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/declared-name","severity":null,"label":"Declared skill name","detail":null,"valueNum":null,"valueText":"vercel-optimize","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T03:31:54.000Z","payload":null},{"origin":"signal","id":"cmuxjx89u1c3tad07uzo4adon","subjectType":"skill_audit","subjectId":"cmuxjx6f91braad07rwefzcjd","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/interactive-prompts","severity":"high","label":"Interactive prompts detected","detail":"Agents run in non-interactive shells — replace prompts with CLI flags or stdin","valueNum":null,"valueText":null,"unit":null,"method":null,"derivation":null,"confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T03:31:54.000Z","payload":null},{"origin":"signal","id":"cmuxjx8731c3bad07fhvagikg","subjectType":"skill_audit","subjectId":"cmuxjx6f91braad07rwefzcjd","relatedType":"","relatedId":"","dataCategory":"compatibility","sourceClass":"scan","source":"vettd","ruleId":"compatibility/structured-output","severity":null,"label":"Structured output","detail":null,"valueNum":null,"valueText":"present","unit":null,"method":null,"derivation":"read","confidence":null,"sampleSize":null,"synthetic":false,"firstParty":true,"observedAt":"2026-10-07T03:31:54.000Z","payload":null}]},{"category":"sentiment","label":"Popularity","form":"unjudged","verdict":null,"rows":[]},{"category":"characteristics","label":"Characteristics","form":"unjudged","verdict":null,"rows":[]}],"signalCount":42,"publisherSupplied":["name","description","author","version","license"]}