{"id":"cmplly38300b1ad089anhwn6q","owner":"vercel-labs","name":"agent-skills","url":"https://github.com/vercel-labs/agent-skills","lastScannedAt":"2026-10-07T03:36:31.392Z","freshness":{"status":"changed","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T10:14:39.064Z","lastVerifiedAt":null,"lastChangeDetectedAt":"2026-10-21T10:14:39.064Z","scannedHash":null,"latestUpstreamHash":"063bee94c3f4df8453406c830b0a7df0f2860278","nextCheckDueAt":"2026-10-22T11:14:09.694Z"},"skills":[{"id":"cmuxhx8jw0gw8ad07e115346d","slug":"web-design-guidelines","publicId":"a14ac157-c9b4-425f-af02-93178f92ca6b","name":"web-design-guidelines","description":"Review UI code for Web Interface Guidelines compliance. Use when asked to \"review my UI\", \"check accessibility\", \"audit design\", \"review UX\", or \"check my site against best practices\".","author":"vercel","version":"1.0.0","license":"","overallGrade":"B","badgeStatus":"conditional","publishedAt":"2026-07-30T16:49:13.748Z","sourceUrl":"https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines","findings":[{"id":"cmuxhx8jw0gw9ad07j02l9hry","source":"vettd","category":"best-practices","label":"Skill name collides with well-known skill","detail":"\"web-design-guidelines\" matches a well-known skill name — may cause unintended invocation","severity":"medium","ruleId":"VTD-0100"},{"id":"cmuxhx8jw0gwaad07gwj408ga","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in SKILL.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088"},{"id":"cmuxhx8jw0gwbad07a6vcvvvi","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"B","criticalCount":0,"highCount":0},{"source":"cisco","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T22:53:02.265Z","lastVerifiedAt":"2026-10-21T22:53:02.265Z","lastChangeDetectedAt":"2026-08-14T14:54:28.669Z","scannedHash":"3116f3e62dbd02b44a598b1aa690d2a8938e8f89","latestUpstreamHash":"3116f3e62dbd02b44a598b1aa690d2a8938e8f89","nextCheckDueAt":"2026-10-23T00:05:31.586Z"}},{"id":"cmuxhx8mf0gx9ad078ca9355n","slug":"writing-guidelines","publicId":"b8ae3978-70fc-4a00-97a2-8ce4d280550a","name":"writing-guidelines","description":"Review docs/prose for Writing Guidelines compliance. Use when asked to \"review my docs\", \"check writing style\", \"audit prose\", \"review docs voice and tone\", or \"check this page against the writing handbook\".","author":"vercel","version":"1.0.0","license":"","overallGrade":"B","badgeStatus":"conditional","publishedAt":"2026-07-30T16:49:12.670Z","sourceUrl":"https://github.com/vercel-labs/agent-skills/tree/main/skills/writing-guidelines","findings":[{"id":"cmuxhx8mg0gxaad073f9ytnb5","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in SKILL.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088"},{"id":"cmuxhx8mg0gxbad0775akwm3t","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"B","criticalCount":0,"highCount":0},{"source":"cisco","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T12:29:39.399Z","lastVerifiedAt":"2026-10-21T12:29:39.399Z","lastChangeDetectedAt":"2026-08-14T15:47:28.675Z","scannedHash":"17d954cadfb8dec50bf0c707c9e7634be9ae9fe8","latestUpstreamHash":"17d954cadfb8dec50bf0c707c9e7634be9ae9fe8","nextCheckDueAt":"2026-10-22T11:17:42.797Z"}},{"id":"cmuxhx5ih0grxad07r7ekqafg","slug":"vercel-react-native-skills","publicId":"89135d7f-939e-4ad2-9d74-02dd3e5f0c20","name":"vercel-react-native-skills","description":"React Native and Expo best practices for building performant mobile apps. Use when building React Native components, optimizing list performance, implementing animations, or working with native modules. Triggers on tasks involving React Native, Expo, mobile performance, or native platform APIs.","author":"vercel","version":"1.0.0","license":"MIT","overallGrade":"A","badgeStatus":"vettd","publishedAt":"2026-07-30T16:49:11.358Z","sourceUrl":"https://github.com/vercel-labs/agent-skills/tree/main/skills/react-native-skills","findings":[],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0},{"source":"cisco","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T10:46:39.290Z","lastVerifiedAt":"2026-10-21T10:46:39.290Z","lastChangeDetectedAt":"2026-08-14T14:29:28.667Z","scannedHash":"8b4c6a51914e2111ab6f4f00cb81778652aa241d","latestUpstreamHash":"8b4c6a51914e2111ab6f4f00cb81778652aa241d","nextCheckDueAt":"2026-10-22T12:47:03.978Z"}},{"id":"cmuxhy5jq0hqfad07dhm3x656","slug":"vercel-react-best-practices","publicId":"0dc81e7c-bd3b-4f28-a750-76feeec7bbae","name":"vercel-react-best-practices","description":"React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.","author":"vercel","version":"1.0.0","license":"MIT","overallGrade":"B","badgeStatus":"conditional","publishedAt":"2026-07-30T16:49:06.371Z","sourceUrl":"https://github.com/vercel-labs/agent-skills/tree/main/skills/react-best-practices","findings":[{"id":"cmuxhy5jq0hqgad07hdat2bkp","source":"vettd","category":"best-practices","label":"Skill name collides with well-known skill","detail":"\"vercel-react-best-practices\" matches a well-known skill name — may cause unintended invocation","severity":"medium","ruleId":"VTD-0100"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"B","criticalCount":0,"highCount":0},{"source":"cisco","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T19:26:41.455Z","lastVerifiedAt":"2026-10-21T19:26:41.455Z","lastChangeDetectedAt":"2026-08-25T13:29:21.578Z","scannedHash":"343db72180d05814949fef7d46be96b5c6ee86b3","latestUpstreamHash":"343db72180d05814949fef7d46be96b5c6ee86b3","nextCheckDueAt":"2026-10-22T17:29:36.096Z"}},{"id":"cmuxhx21n0g33ad07nzm7r1pf","slug":"vercel-cli-with-tokens","publicId":"61f65094-499c-4bf8-aeed-94462ae17489","name":"vercel-cli-with-tokens","description":"Deploy and manage projects on Vercel using token-based authentication. Use when working with Vercel CLI using access tokens rather than interactive login — e.g. \"deploy to vercel\", \"set up vercel\", \"add environment variables to vercel\".","author":"vercel","version":"1.0.0","license":"","overallGrade":"B","badgeStatus":"conditional","publishedAt":"2026-07-30T16:48:59.017Z","sourceUrl":"https://github.com/vercel-labs/agent-skills/tree/main/skills/vercel-cli-with-tokens","findings":[{"id":"cmuxhx21n0g34ad07ith0p0lj","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in SKILL.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088"},{"id":"cmuxhx21n0g35ad0780izxryy","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"B","criticalCount":0,"highCount":0},{"source":"cisco","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-22T00:38:07.005Z","lastVerifiedAt":"2026-10-22T00:38:07.005Z","lastChangeDetectedAt":"2026-08-25T12:28:05.108Z","scannedHash":"279c8760375cb6a47a4a8a312b652b0745c6d776","latestUpstreamHash":"279c8760375cb6a47a4a8a312b652b0745c6d776","nextCheckDueAt":"2026-10-23T00:26:19.332Z"}},{"id":"cmuxhy4bl0hgmad07qqvsa075","slug":"deploy-to-vercel","publicId":"1a9c7b8d-19dc-43b5-bf46-b792bfe4f8cf","name":"deploy-to-vercel","description":"Deploy applications and websites to Vercel. Use when the user requests deployment actions like \"deploy my app\", \"deploy and give me the link\", \"push this live\", or \"create a preview deployment\".","author":"vercel","version":"3.0.0","license":"","overallGrade":"C","badgeStatus":"flagged","publishedAt":"2026-07-30T16:48:57.853Z","sourceUrl":"https://github.com/vercel-labs/agent-skills/tree/main/skills/deploy-to-vercel","findings":[{"id":"cmuxhy4bm0hgnad07nfgdoliq","source":"vettd","category":"security","label":"Remote content fetched into variable for execution","detail":"Detected in resources/deploy-codex.sh:239 — `RESPONSE=$(curl -s -X POST \"$DEPLOY_ENDPOINT\" -F \"file=@$TARBALL\" -F \"framework=$FRAMEWORK\")`","severity":"high","ruleId":"VTD-0022"},{"id":"cmuxhy4bm0hgoad07arccytnh","source":"vettd","category":"security","label":"Remote content fetched into variable for execution","detail":"Detected in resources/deploy.sh:239 — `RESPONSE=$(curl -s -X POST \"$DEPLOY_ENDPOINT\" -F \"file=@$TARBALL\" -F \"framework=$FRAMEWORK\")`","severity":"high","ruleId":"VTD-0022"},{"id":"cmuxhy4bm0hgpad075dk74nem","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in SKILL.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088"},{"id":"cmuxhy4bm0hgqad07s8bojrmb","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"},{"id":"cmuxhy4bm0hgrad070mrrjgnt","source":"cisco","category":"security","label":"Script contacts a destination the documentation never mentions","detail":"resources/deploy-codex.sh:9 — Script contacts or configures 'codex-deploy-skills.vercel.sh' but the skill documentation never visibly mentions it. Undocumented network destinations can indicate behaviour the manifest and description do not disclose.","severity":"low","ruleId":"UNDECLARED_NETWORK_DESTINATION"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"C","criticalCount":0,"highCount":2},{"source":"cisco","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T19:56:41.522Z","lastVerifiedAt":"2026-10-21T19:56:41.522Z","lastChangeDetectedAt":"2026-08-14T14:26:28.667Z","scannedHash":"1378aa506439f26c809dbcfc61515cbd70f93d69","latestUpstreamHash":"1378aa506439f26c809dbcfc61515cbd70f93d69","nextCheckDueAt":"2026-10-22T20:34:26.271Z"}},{"id":"cmuxk2yim1nlqad07we3rm7pc","slug":"vercel-react-view-transitions","publicId":"fe4a65bd-abab-4a4b-b667-c6e78a34c2ae","name":"vercel-react-view-transitions","description":"Guide for implementing smooth, native-feeling animations using React's View Transition API (`<ViewTransition>` component, `addTransitionType`, and CSS view transition pseudo-elements). Use this skill whenever the user wants to add page transitions, animate route changes, create shared element animations, animate enter/exit of components, animate list reorder, implement directional (forward/back) navigation animations, or integrate view transitions in Next.js. Also use when the user mentions view transitions, `startViewTransition`, `ViewTransition`, transition types, or asks about animating between UI states in React without third-party animation libraries.","author":"vercel","version":"1.0.0","license":"MIT","overallGrade":"B","badgeStatus":"conditional","publishedAt":"2026-07-30T16:48:56.679Z","sourceUrl":"https://github.com/vercel-labs/agent-skills/tree/main/skills/react-view-transitions","findings":[{"id":"cmuxk2yim1nlrad070jxxks5n","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in references/css-recipes.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"B","criticalCount":0,"highCount":0},{"source":"cisco","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T17:17:41.165Z","lastVerifiedAt":"2026-10-21T17:17:41.165Z","lastChangeDetectedAt":"2026-10-08T01:46:35.406Z","scannedHash":"13063dbbfc1b085cbc11b9bd5d4324aa2f41bb3a","latestUpstreamHash":"13063dbbfc1b085cbc11b9bd5d4324aa2f41bb3a","nextCheckDueAt":"2026-10-22T15:29:29.746Z"}},{"id":"cmuxho37n00gpad07g63toe5o","slug":"vercel-optimize","publicId":"91d29ff9-c585-4a7f-b96b-e68fe054a910","name":"vercel-optimize","description":"Use for Vercel cost and performance optimization on deployed projects, especially Next.js, SvelteKit, Nuxt, and limited Astro apps. Collect Vercel metrics, usage, project config, and code scan results first; investigate only metric-backed candidates; produce ranked recommendations grounded in verified files and version-aware Vercel/framework docs. Trigger for Vercel bill reduction, slow or expensive routes, caching opportunities, Function Invocations, Build Minutes, Fast Data Transfer, Core Web Vitals, Bot Management, Fluid compute, or cost breakdown requests.","author":"","version":"1.2.0","license":"","overallGrade":"F","badgeStatus":"flagged","publishedAt":"2026-06-02T03:34:04.023Z","sourceUrl":"https://github.com/vercel-labs/agent-skills/tree/main/skills/vercel-optimize","findings":[{"id":"cmuxho39p00gqad079izkcbsb","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in lib/sanitizers/undeclared-dep.mjs:10 — `'dns', 'tls', 'util', 'url', 'stream', 'buffer', 'events', 'process', 'child_process',`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmuxho39p00grad07q0jpj9dd","source":"vettd","category":"security","label":"Safety bypass flag detected","detail":"Detected in lib/scanners/turbo-force-bypass.mjs:5 — `//   force-flag      — `TURBO_FORCE=true` env var or `turbo run ... --force` in build script`","severity":"low","ruleId":"VTD-0028"},{"id":"cmuxho39p00gsad07l72foqs9","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in lib/vercel.mjs:1 — `// Vercel CLI helpers. All shell-outs use execFile (not exec) — no shell injection. Error detection: exit code + JSON-pa`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmuxho39p00gtad078n0nuced","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in lib/verify-claim.mjs:4 — `import { execFile } from 'node:child_process';`","severity":"critical","ruleId":"VTD-0018"},{"id":"cmuxho39p00guad07fxv9vuc7","source":"vettd","category":"security","label":"Safety bypass flag detected","detail":"Detected in scripts/merge-signals.mjs:18 — `console.error('usage: node scripts/merge-signals.mjs <signals.json> <codebase.json> [--out merged.json] [--force]');`","severity":"low","ruleId":"VTD-0028"},{"id":"cmuxho39p00gvad070jtzkdzn","source":"vettd","category":"security","label":"Safety bypass flag detected","detail":"Detected in scripts/prepare-investigation-brief.mjs:208 — `else if (a === '--force') out.force = true;`","severity":"low","ruleId":"VTD-0028"},{"id":"cmuxho39p00gwad077jg8ebyf","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in references/candidates.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088"},{"id":"cmuxho39p00gxad076roadphx","source":"cisco","category":"security","label":"Skill package contains many files","detail":". — Skill package contains 156 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.","severity":"low","ruleId":"EXCESSIVE_FILE_COUNT"},{"id":"cmuxho39p00gyad07bgm5b3af","source":"cisco","category":"security","label":"Skill does not specify a license","detail":"SKILL.md — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.","severity":"info","ruleId":"MANIFEST_MISSING_LICENSE"},{"id":"cmuxho39p00gzad07gc3p1q75","source":"cisco","category":"security","label":"Outbound network request primitives in JavaScript/TypeScript","detail":"lib/grade-recommendation.mjs:6 — Pattern detected: fetch(","severity":"medium","ruleId":"DATA_EXFIL_JS_NETWORK"},{"id":"cmuxho39p00h0ad07cqwc06l8","source":"cisco","category":"security","label":"Outbound network request primitives in JavaScript/TypeScript","detail":"lib/investigation-brief.mjs:605 — Pattern detected: fetch(","severity":"medium","ruleId":"DATA_EXFIL_JS_NETWORK"},{"id":"cmuxho39p00h1ad075uwtimj4","source":"cisco","category":"security","label":"Outbound network request primitives in JavaScript/TypeScript","detail":"lib/scanners/cache-components-suspense-dedupe.mjs:65 — Pattern detected: fetch(","severity":"medium","ruleId":"DATA_EXFIL_JS_NETWORK"},{"id":"cmuxho39p00h2ad07h7hjtm39","source":"cisco","category":"security","label":"Outbound network request primitives in JavaScript/TypeScript","detail":"lib/scanners/missing-cache-headers.mjs:13 — Pattern detected: fetch(","severity":"medium","ruleId":"DATA_EXFIL_JS_NETWORK"},{"id":"cmuxho39p00h3ad07gcwcwzjv","source":"cisco","category":"security","label":"Outbound network request primitives in JavaScript/TypeScript","detail":"lib/scanners/missing-cache-headers.mjs:15 — Pattern detected: fetch(","severity":"medium","ruleId":"DATA_EXFIL_JS_NETWORK"},{"id":"cmuxho39p00h4ad07l2ika504","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"lib/vercel.mjs:3 — Pattern detected: from 'node:child_process'","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"},{"id":"cmuxho39q00h5ad07lcmrazy5","source":"cisco","category":"security","label":"Dangerous code execution functions that can execute arbitrary code","detail":"lib/vercel.mjs:87 — Pattern detected: exec(","severity":"critical","ruleId":"COMMAND_INJECTION_EVAL"},{"id":"cmuxho39q00h6ad07j4kxvmge","source":"cisco","category":"security","label":"Node.js child_process module usage for shell command execution","detail":"lib/verify-claim.mjs:4 — Pattern detected: from 'node:child_process'","severity":"critical","ruleId":"COMMAND_INJECTION_JS_CHILD_PROCESS"}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"F","criticalCount":3,"highCount":3},{"source":"cisco","status":"success","verdict":null,"grade":"F","criticalCount":3,"highCount":3}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T17:45:41.212Z","lastVerifiedAt":"2026-10-21T17:45:41.212Z","lastChangeDetectedAt":"2026-08-14T14:04:28.661Z","scannedHash":"0901aa3667db7a6e5cc40b213327290bf6556373","latestUpstreamHash":"0901aa3667db7a6e5cc40b213327290bf6556373","nextCheckDueAt":"2026-10-22T15:49:22.724Z"}},{"id":"cmuxhnxkd004had07ti81ensp","slug":"vercel-composition-patterns-2","publicId":"672bc734-3547-4831-b613-6d853716ff99","name":"vercel-composition-patterns","description":"React composition patterns that scale. Use when refactoring components with boolean prop proliferation, building flexible component libraries, or designing reusable APIs. Triggers on tasks involving compound components, render props, context providers, or component architecture. Includes React 19 API changes.","author":"vercel","version":"1.0.0","license":"MIT","overallGrade":"A","badgeStatus":"vettd","publishedAt":"2026-05-25T19:37:45.405Z","sourceUrl":"https://github.com/vercel-labs/agent-skills/tree/main/skills/composition-patterns","findings":[],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0},{"source":"cisco","status":"success","verdict":null,"grade":"A","criticalCount":0,"highCount":0}],"freshness":{"status":"verified_unchanged","reason":null,"retryable":false,"renamedTo":null,"lastCheckedAt":"2026-10-21T10:41:39.281Z","lastVerifiedAt":"2026-10-21T10:41:39.281Z","lastChangeDetectedAt":"2026-08-14T13:16:28.623Z","scannedHash":"bf90d0a4b83ea054653350f9c67f6de235d3a368","latestUpstreamHash":"bf90d0a4b83ea054653350f9c67f6de235d3a368","nextCheckDueAt":"2026-10-22T09:01:25.989Z"}}],"publisherSupplied":["skills[].name","skills[].description","skills[].author","skills[].version","skills[].license"]}