vercel-deploy
Deploy applications and websites to Vercel. Use when the user requests deployment actions like "deploy my app", "deploy and give me the link", "push this live", or "create a preview deployment".
Security Assessment
About vercel-deploy
The vercel-deploy skill deploys applications and websites to Vercel in response to requests like deploy my app, push this live, or create a preview deployment. Its default behavior is deliberate: it always creates a preview deployment rather than production unless the user explicitly asks for production, in which case the deploy command adds a production flag.
The workflow begins by checking whether the Vercel CLI is present using a non-escalated check such as command -v vercel. If the CLI is available, it runs the deploy against the target path with automatic confirmation, using a ten-minute (600000 ms) timeout because builds can take several minutes. If the CLI is missing or reports that no credentials are found, it falls back to a bundled deploy.sh script that handles framework detection, packaging, and deployment, waits for the build to complete, and returns JSON containing a preview URL and a claim URL to hand to the user.
The skill is intentionally conservative about verification and permissions: it does not curl or fetch the deployed URL to confirm it works, simply returning the link instead. If deployment fails due to network problems like timeouts, DNS errors, or connection resets under sandboxing, the guidance is to rerun only the actual deploy command with escalated permissions -- never the CLI installation check -- so that outbound requests to Vercel can go through.
FAQ
Does it deploy to production by default?
No. It always deploys as a preview unless the user explicitly asks for production, in which case it adds the production flag to the deploy command.
What timeout should the deploy command use?
A ten-minute (600000 ms) timeout, because builds can take a while to complete.
What happens if the Vercel CLI is not installed or has no credentials?
It falls back to a bundled deploy.sh script that handles framework detection, packaging, and deployment, then returns JSON with a previewUrl and a claimUrl to share with the user.
Does it verify that the deployment works?
No. It explicitly does not curl or fetch the deployed URL to verify it; it just returns the link (and the claim URL for fallback deployments).
How does it handle network or sandbox failures?
If the deploy fails due to network issues, it reruns the actual deploy command with escalated permissions; the non-escalated CLI installation check is never escalated.
Install vercel-deploy
Quick Setup:
- Copy the skill folder to
.claude/skills/ - Claude will automatically detect and use the skill
Repository
openai/skills