Skip to content
skillsafebeta
← Report library
Purpose / Other

Vercel Cli With Tokens Skill Security Audit

What the author says it does (original text)

Deploy and manage projects on Vercel using token-based authentication. Use when working with Vercel CLI using access tokens rather than interactive login — e.g. "deploy to vercel", "set up vercel", "add environment variables to vercel".

Independent security check

Do not install or run it yet

Files checked
1
Risks found
5
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

The Skill globally installs an unpinned Vercel CLI version

Source references: 2
What we found

It runs `npm install -g vercel` without pinning a version or requiring package-source verification. A global installation changes the user's development environment and runs installation behavior permitted by the downloaded npm package.

Why this matters

CLI behavior can change with the latest release. If the package source, a dependency, or a publisher account is compromised, installation code runs with the current user's permissions and may affect files and credentials that user can access.

The setup step directly calls for an unpinned global npm installation and says the CLI should be up to date. This changes the user's global development environment, while installed content depends on the package version published at that time. The package name is consistent with Vercel CLI, but the text provides no version pin, source verification, or pre-install approval. Users can require a pinned, project-local or isolated installation and verify source and permissions first.

SKILL.md:97In the instructionsOpen original file
## CLI SetupEnsure the Vercel CLI is installed and up to date:```bashnpm install -g vercelvercel --version```
Show 1 other places
SKILL.md:349In the instructionsOpen original file
### CLI not installed```bashnpm install -g vercel```
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
High risk

Token-discovery commands can expose full Vercel credentials in agent records

Source references: 6
What we found

The Skill explicitly runs `printenv VERCEL_TOKEN` and the broad command `grep -i 'vercel' .env`. These commands print matching values to standard output, so an agent or automated terminal can copy the full token and other matching Vercel settings into chat, tool output, or logs. If none is found, it asks the user to provide a token directly.

Why this matters

Anyone able to read those outputs or conversation records could use the token within its granted scope to access Vercel projects, deployments, and account configuration. The broad grep may reveal more than one related secret.

This is an active credential-discovery flow, not merely an example. It prints `VERCEL_TOKEN` and later outputs every `.env` line containing “vercel,” so full tokens and other configuration could enter agent tool output or logs. The warning against `--token` only addresses shell history and process listings; it does not protect discovery-command output. Users can ask for presence-only checks, redacted output, and a secure secret-input mechanism.

SKILL.md:17In the instructionsOpen original file
### A) `VERCEL_TOKEN` is already set in the environment```bashprintenv VERCEL_TOKEN```
Show 5 other places
SKILL.md:37In the instructionsOpen original file
### C) Token is in a `.env` file under a different nameLook for any variable that looks like a Vercel token (Vercel tokens typically start with `vca_`):```bashgrep -i 'vercel' .env 2>/dev/null```Inspect the output to identify which variable holds the token, then export it as `VERCEL_TOKEN`:
SKILL.md:51In the instructionsOpen original file
### D) No token found — ask the userIf none of the above yield a token, ask the user to provide one. They can create a Vercel access token at vercel.com/account/tokens.---**Important:** Once `VERCEL_TOKEN` is exported as an environment variable, the Vercel CLI reads it natively — **do not pass it as a `--token` flag**. Putting secrets in command-line arguments exposes them in shell history and process listings.
SKILL.md:314In the instructionsOpen original file
Check the environment and any `.env` files present:```bashprintenv | grep -i vercelgrep -i vercel .env 2>/dev/null```
SKILL.md:15In the instructionsOpen original file
Before running any Vercel CLI commands, identify where the token is coming from. Work through these scenarios in order:### A) `VERCEL_TOKEN` is already set in the environment```bashprintenv VERCEL_TOKEN```
SKILL.md:39In the instructionsOpen original file
Look for any variable that looks like a Vercel token (Vercel tokens typically start with `vca_`):```bashgrep -i 'vercel' .env 2>/dev/null```Inspect the output to identify which variable holds the token, then export it as `VERCEL_TOKEN`:
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 2
Medium risk

Pulling remote environment variables creates a local secrets file

Source references: 2
What we found

`vercel env pull` is presented as a routine management command and downloads project environment variables into `.env.local` in the current directory. The Skill does not require confirmation first or check whether that file may be versioned, backed up, or shared.

Why this matters

Production or preview secrets can persist on disk and may later be committed, synchronized, backed up, or read by other processes on the machine.

The command is presented as a normal environment-management operation and explicitly pulls remote variables into local `.env.local`. This can leave secrets in the workspace, backups, or shared files; the surrounding instructions require neither prior confirmation nor an ignore-rule check. Whether secrets are actually present depends on the project. Users can prohibit this operation or require confirmation of the directory, overwrite behavior, and version-control exclusions first.

SKILL.md:241In the instructionsOpen original file
# List environment variablesvercel env ls --scope <team-slug># Pull env vars to local .env.local filevercel env pull --scope <team-slug>
Show 1 other places
SKILL.md:232In the instructionsOpen original file
## Managing Environment Variables```bash# Set for all environmentsecho "value" | vercel env add VAR_NAME --scope <team-slug># Set for a specific environment (production, preview, development)echo "value" | vercel env add VAR_NAME production --scope <team-slug># List environment variablesvercel env ls --scope <team-slug># Pull env vars to local .env.local filevercel env pull --scope <team-slug>
Medium risk

The deployment flow stages the entire working tree with `git add .`

Source references: 2
What we found

After push approval, the Skill instructs the agent to run `git add .` rather than staging only reviewed files required for the deployment. This can include unrelated changes, generated files, or secrets that are not ignored.

Why this matters

The following commit and push may permanently record local configuration, credentials, or unrelated work in the repository and transmit it to the remote. Although push approval is required, the user may not know the actual staging scope.

The flow does require user approval before pushing, which reduces unauthorized-push risk. After approval, however, `git add .` stages every unignored change under the current directory rather than a reviewed deployment file set. Unrelated changes or unignored credentials could then be committed and pushed. Users can scope approval to named files and require review of the staged diff and secret-scan results before commit.

SKILL.md:180In the instructionsOpen original file
Git pushes trigger automatic Vercel deployments.1. **Ask the user before pushing.** Never push without explicit approval.2. Commit and push:   ```bash   git add .   git commit -m "deploy: <description of changes>"   git push   ```3. Vercel builds automatically. Non-production branches get preview deployments.
Show 1 other places
SKILL.md:178In the instructionsOpen original file
**A) Git Push Deploy — has git remote (preferred)**Git pushes trigger automatic Vercel deployments.1. **Ask the user before pushing.** Never push without explicit approval.2. Commit and push:   ```bash   git add .   git commit -m "deploy: <description of changes>"   git push   ```3. Vercel builds automatically. Non-production branches get preview deployments.
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

Automatic `-y` confirmation can apply account changes without a final check

Source references: 5
What we found

The Skill makes `-y` a general rule for bypassing interactive confirmation and uses it for environment-variable removal, project linking, and deployment. Removing an environment variable has no separate user-approval requirement; linking also creates local Vercel metadata and determines which account target later commands affect.

Why this matters

If the variable name, team scope, project, or current-directory assessment is wrong, a command may remove remote configuration, link the wrong project, or deploy to the wrong account without the CLI's final prompt stopping it.

This is a real control risk, though impact varies by command. The skill uses `-y` to link projects and create local Vercel metadata, and to remove a remote environment variable without an interactive prompt; its working agreement generally recommends `-y`. Approval is expressly required for Git pushes and paid/destructive plan changes, but not for environment-variable removal. Users can require separate approval showing the exact team, project, and variable before deletion or first-time linking.

SKILL.md:150In the instructionsOpen original file
#### Link the project**With git remote (preferred):**```bashvercel link --repo --scope <team-slug> -y```Reads the git remote and connects to the matching Vercel project. Creates `.vercel/repo.json`. More reliable than plain `vercel link`, which matches by directory name.**Without git remote:**```bashvercel link --scope <team-slug> -y```Creates `.vercel/project.json`.
Show 4 other places
SKILL.md:247In the instructionsOpen original file
# Remove a variablevercel env rm VAR_NAME --scope <team-slug> -y```
SKILL.md:303In the instructionsOpen original file
- **Check the environment for tokens before asking the user.** Look in the current env and `.env` files first.- **Default to preview deployments.** Only deploy to production when explicitly asked.- **Ask before pushing to git.** Never push commits without the user's approval.- **Do not modify `.vercel/` files directly.** The CLI manages this directory. Reading them (e.g. to verify `orgId`) is fine.- **Do not curl/fetch deployed URLs to verify.** Just return the link to the user.- **Use `--format json`** when structured output will help with follow-up steps.- **Use `-y`** on commands that prompt for confirmation to avoid interactive blocking.
SKILL.md:152In the instructionsOpen original file
**With git remote (preferred):**```bashvercel link --repo --scope <team-slug> -y```Reads the git remote and connects to the matching Vercel project. Creates `.vercel/repo.json`. More reliable than plain `vercel link`, which matches by directory name.
SKILL.md:301In the instructionsOpen original file
- **Never pass `VERCEL_TOKEN` as a `--token` flag.** Export it as an environment variable and let the CLI read it natively.- **Check the environment for tokens before asking the user.** Look in the current env and `.env` files first.- **Default to preview deployments.** Only deploy to production when explicitly asked.- **Ask before pushing to git.** Never push commits without the user's approval.- **Do not modify `.vercel/` files directly.** The CLI manages this directory. Reading them (e.g. to verify `orgId`) is fine.- **Do not curl/fetch deployed URLs to verify.** Just return the link to the user.- **Use `--format json`** when structured output will help with follow-up steps.- **Use `-y`** on commands that prompt for confirmation to avoid interactive blocking.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill searches the current environment or the project's `.env` file for a Vercel token, organization ID, and project ID, then lets the Vercel CLI read those credentials from environment variables.

View source
SKILL.md:15In the instructionsOpen original file
Before running any Vercel CLI commands, identify where the token is coming from. Work through these scenarios in order:### A) `VERCEL_TOKEN` is already set in the environment```bashprintenv VERCEL_TOKEN```
SKILL.md:70In the instructionsOpen original file
Similarly, check for the project ID and team scope. These let the CLI target the right project without needing `vercel link`.```bash# Check environmentprintenv VERCEL_PROJECT_IDprintenv VERCEL_ORG_ID# Or check .envgrep -i 'vercel' .env 2>/dev/null```

The Skill goes beyond code deployment: it includes project linking, environment-variable management, domain management, and paid plan changes through Stripe Projects. It requires explicit permission for production deployments and plan changes, but does not impose the same per-action confirmation rule on some other account changes.

View source
SKILL.md:108In the instructionsOpen original file
Always deploy as **preview** unless the user explicitly requests production. Choose a method based on what you have available.
SKILL.md:232In the instructionsOpen original file
## Managing Environment Variables```bash# Set for all environmentsecho "value" | vercel env add VAR_NAME --scope <team-slug># Set for a specific environment (production, preview, development)echo "value" | vercel env add VAR_NAME production --scope <team-slug># List environment variablesvercel env ls --scope <team-slug># Pull env vars to local .env.local filevercel env pull --scope <team-slug># Remove a variablevercel env rm VAR_NAME --scope <team-slug> -y```
SKILL.md:267In the instructionsOpen original file
## Managing Domains```bash# List domainsvercel domains ls --scope <team-slug># Add a domain to the project — linked or env-linked directory (1 arg)vercel domains add <domain> --scope <team-slug># Add a domain — unlinked directory (requires <project> positional)vercel domains add <domain> <project> --scope <team-slug>```
SKILL.md:280In the instructionsOpen original file
## Stripe Projects Plan ChangesIf this project is managed by Stripe Projects. **Ask the user before running any paid or destructive plan change** — upgrades bill a real card, downgrades remove seats.First run `stripe projects status --json` to confirm the Vercel resource's local name. The examples below assume the default (`vercel-plan`); substitute the actual name if it was renamed at `stripe projects add` time.- **Upgrade to Pro:** `stripe projects add vercel/pro` (or `stripe projects upgrade vercel-plan pro`)- **Downgrade to Hobby:** `stripe projects downgrade vercel-plan hobby`
Start here · InstructionsSKILL.md
vercel-cli-with-tokens
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 2 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:19In the instructionsOpen original file
```bashprintenv VERCEL_TOKEN
SKILL.md:27In the instructionsOpen original file
```bashgrep '^VERCEL_TOKEN=' .env 2>/dev/null
SKILL.md:33In the instructionsOpen original file
```bashexport VERCEL_TOKEN=$(grep '^VERCEL_TOKEN=' .env | cut -d= -f2-)
Read keys or account settings
SKILL.md:25In the instructionsOpen original file
### B) Token is in a `.env` file under `VERCEL_TOKEN`
SKILL.md:28In the instructionsOpen original file
```bashgrep '^VERCEL_TOKEN=' .env 2>/dev/null```
SKILL.md:34In the instructionsOpen original file
```bashexport VERCEL_TOKEN=$(grep '^VERCEL_TOKEN=' .env | cut -d= -f2-)```
Connect to websites
SKILL.md:81In the instructionsOpen original file
**If you have a project URL** (e.g. `https://vercel.com/my-team/my-project`), extract the team slug:
SKILL.md:84In the instructionsOpen original file
```bash# e.g. "my-team" from "https://vercel.com/my-team/my-project"echo "$PROJECT_URL" | sed 's|https://vercel.com/||' | cut -d/ -f1
SKILL.md:85In the instructionsOpen original file
# e.g. "my-team" from "https://vercel.com/my-team/my-project"echo "$PROJECT_URL" | sed 's|https://vercel.com/||' | cut -d/ -f1```
Install extra software packages
SKILL.md:102In the instructionsOpen original file
```bashnpm install -g vercelvercel --version
SKILL.md:352In the instructionsOpen original file
```bashnpm install -g vercel```
Read files
SKILL.md:147In the instructionsOpen original file
# Is it already linked to a Vercel project?cat .vercel/project.json 2>/dev/null || cat .vercel/repo.json 2>/dev/null```
Change files
SKILL.md:248In the instructionsOpen original file
# Remove a variablevercel env rm VAR_NAME --scope <team-slug> -y```
Lines read
354
File checksum (to compare versions)
332898099808d228eb9ef727239ab0d36133a95bf4fd873f3322f1d713e31c03