Review Security Report
PrefectHQ/fastmcp
Review FastMCP vulnerability reports before accepting, rejecting, patching, scoring, or publishing them.
Vercel Connect expert guidance for securely obtaining scoped credentials for third-party services on behalf of apps or users.
$ npx skills add vercel/vercel-plugin --skill vercel-connect -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install vercel/vercel-plugin vercel-connect --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/vercel/vercel-plugin.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/vercel-connect .claude/skills/vercel-connect && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "vercel-connect" agent skill from https://github.com/vercel/vercel-plugin/tree/main/skills/vercel-connect into .claude/skills/vercel-connect/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vercel-connect", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/vercel/vercel-plugin/tree/main/skills/vercel-connectType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add vercel/vercel-plugin --skill vercel-connect -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install vercel/vercel-plugin vercel-connect --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/vercel/vercel-plugin.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/vercel-connect .agents/skills/vercel-connect && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "vercel-connect" agent skill from https://github.com/vercel/vercel-plugin/tree/main/skills/vercel-connect into .agents/skills/vercel-connect/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vercel-connect", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add vercel/vercel-plugin --skill vercel-connect -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install vercel/vercel-plugin vercel-connect --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/vercel/vercel-plugin.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/vercel-connect .cursor/skills/vercel-connect && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "vercel-connect" agent skill from https://github.com/vercel/vercel-plugin/tree/main/skills/vercel-connect into .cursor/skills/vercel-connect/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vercel-connect", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/vercel/vercel-plugin.git --path skills/vercel-connect--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add vercel/vercel-plugin --skill vercel-connect -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install vercel/vercel-plugin vercel-connect --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/vercel/vercel-plugin.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/vercel-connect .gemini/skills/vercel-connect && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "vercel-connect" agent skill from https://github.com/vercel/vercel-plugin/tree/main/skills/vercel-connect into .gemini/skills/vercel-connect/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vercel-connect", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install vercel/vercel-plugin vercel-connectInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add vercel/vercel-plugin --skill vercel-connect -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/vercel/vercel-plugin.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/vercel-connect .github/skills/vercel-connect && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "vercel-connect" agent skill from https://github.com/vercel/vercel-plugin/tree/main/skills/vercel-connect into .github/skills/vercel-connect/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vercel-connect", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add vercel/vercel-plugin --skill vercel-connect -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install vercel/vercel-plugin vercel-connect --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/vercel/vercel-plugin.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/vercel-connect .opencode/skills/vercel-connect && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "vercel-connect" agent skill from https://github.com/vercel/vercel-plugin/tree/main/skills/vercel-connect into .opencode/skills/vercel-connect/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vercel-connect", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
vercel-connectVercel Connect expert guidance for securely obtaining scoped credentials for third-party services on behalf of apps or users.
Vercel Connect is an agent skill from vercel/vercel-plugin, published by the product's own GitHub organization. Vercel Connect expert guidance for securely obtaining scoped credentials for third-party services on behalf of apps or users. Use when wiring up provider API access, OAuth, API-key services, MCP servers, triggers, framework adapters, or eve agent connections.
Its SKILL.md is about 5.3k tokens, which your agent loads only when the skill is triggered. The skill folder holds 1 other file.
It sits in Backend & APIs, covering OAuth and OpenID Connect and MCP servers. It works with Vercel, Model Context Protocol and Slack. The repository describes itself as: Comprehensive Vercel ecosystem plugin — relational knowledge graph, skills for every major product, specialized agents, and Vercel conventions. Turns any AI agent into a Vercel…
8 steps, taken from the first numbered list in SKILL.md.
Read from SKILL.md and the folder at commit 82fa491. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Shell commands in SKILL.md call:
vercelFrom the folder's file list and the shell code blocks in SKILL.md.
Hosts in commands or code, which the agent is likely to contact:
slack.comapi.vercel.commcp.linear.appAlso links to:
vercel.comeve.devFrom URLs in SKILL.md, links to its own repository left out.
Names these keys or tokens, usually read from environment variables:
VERCEL_OIDC_TOKENSLACK_BOT_TOKENSLACK_SIGNING_SECRETGITHUB_APP_PRIVATE_KEYGITHUB_WEBHOOK_SECRETLINEAR_ACCESS_TOKENLINEAR_WEBHOOK_SECRETFrom names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Vercel Connect loads about 5.3k tokens when it runs. Until then it costs about 69 tokens; SKILL.md has 1,830 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
Its licence (Custom licence) doesn't allow us to republish the file, so here is its outline and opening line. It has 1,830 words (~5,269 tokens).
“Vercel Connect gives applications short-lived provider credentials without storing provider API keys or refresh tokens in project environment variables. A Vercel deployment authenticates with its project OIDC token. External CI or non-Vercel runtimes can pass a scoped Vercel access token…”
SKILL.md and 1 other file in skills/vercel-connect of vercel/vercel-plugin.
Open the folder on GitHubat commit 82fa491
Vercel Connect next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Vercel Connect this skillvercel/vercel-plugin | 301 | — | ~5.3k | Automated safety check: Pass | Custom licence | |
| Review Security ReportPrefectHQ/fastmcp | 28k | — | ~1.2k | Automated safety check: Pass | Apache-2.0 | |
| Xquik MCPXquik-dev/x-twitter-scraper | 209 | — | ~997 | Automated safety check: Pass | MIT | |
| MCP Dart Streamable HTTPleehack/mcp_dart | 116 | — | ~2k | Automated safety check: Pass | MIT | |
| Unifapiunifapi-agent/agents | 586 | — | ~741 | Automated safety check: Pass | MIT | |
| E2a Setuptokencanopy/e2a | 192 | — | ~820 | Automated safety check: Pass | Apache-2.0 |
PrefectHQ/fastmcp
Review FastMCP vulnerability reports before accepting, rejecting, patching, scoring, or publishing them.
Xquik-dev/x-twitter-scraper
Connect, verify, and troubleshoot Xquik's remote MCP server.
leehack/mcp_dart
A skill your agent uses when serving an MCP server over HTTP with mcpdart or connecting to a remote one: StreamableMcpServer setup, Host and Origin allowlists (DNS rebinding protection), CORS for…
unifapi-agent/agents
A skill your agent uses when working with UnifAPI public-data APIs or the UnifAPI MCP server: connecting OAuth MCP clients, discovering operations, calling social/search/scrape/news APIs…
tokencanopy/e2a
A skill your agent uses when a user wants to connect or authorize the e2a MCP server, select or create an agent inbox, verify first-run readiness, or set up a custom email domain.
Luciole-Studio/Misaka-Agent
Manual OAuth for remote MCP servers on headless gateways. An agent skill from Luciole-Studio/Misaka-Agent.
vercel/vercel-plugin
Vercel deployment and CI/CD expert guidance. An agent skill from vercel/vercel-plugin.
vercel/vercel-plugin
Audit vercel-plugin performance on real-world projects. An agent skill from vercel/vercel-plugin.
vercel/vercel-plugin
Vercel CLI expert guidance. An agent skill from vercel/vercel-plugin.
vercel/vercel-plugin
Vercel AI Gateway guidance for setup, model discovery, authentication, routing, fallbacks, virtual models, evaluation models, BYOK, budgets, spend reporting, observability, compatible APIs, and…
vercel/vercel-plugin
Configure and troubleshoot Vercel Services for multiple frontends and backends in one project.
vercel/vercel-plugin
Access and test Vercel deployments protected by Vercel Authentication, SSO, or Deployment Protection.
Works with
Categories
Vercel Connect expert guidance for securely obtaining scoped credentials for third-party services on behalf of apps or users. Vercel Connect is an agent skill from vercel/vercel-plugin, published by the product's own GitHub organization. Vercel Connect expert guidance for securely obtaining scoped credentials for third-party services on behalf of apps or users.
Vercel Connect fits situations like: wiring up provider API access; API-key services; framework adapters; eve agent connections.
Run `npx skills add vercel/vercel-plugin --skill vercel-connect -a claude-code`. Or copy the skill folder (skills/vercel-connect in vercel/vercel-plugin) into .claude/skills/vercel-connect in your project. Claude Code loads it when a task matches its description.
Run `npx skills add vercel/vercel-plugin --skill vercel-connect -a codex`. Or copy the skill folder (skills/vercel-connect in vercel/vercel-plugin) into .agents/skills/vercel-connect in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add vercel/vercel-plugin --skill vercel-connect -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/vercel-connect, .gemini/skills/vercel-connect, .github/skills/vercel-connect and .opencode/skills/vercel-connect in your project.
Going by SKILL.md and its folder, Vercel Connect needs the command-line tools its instructions call (vercel) and credentials named VERCEL_OIDC_TOKEN, SLACK_BOT_TOKEN, SLACK_SIGNING_SECRET and GITHUB_APP_PRIVATE_KEY. Our summary lists: A credential in APP_PRIVATE_KEY; A credential in WEBHOOK_SECRET.
SKILL.md names 5 domains. In commands or code: slack.com, api.vercel.com and mcp.linear.app; the agent is likely to contact these when it follows the instructions. As links in the text: vercel.com and eve.dev. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
Vercel Connect has a licence file (the repository's licence) that doesn't match a standard licence. Read it on GitHub before reusing the skill.
About 5.3k tokens (SKILL.md is roughly 21k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
Skills that share tags, products or a category with Vercel Connect: Review Security Report (PrefectHQ/fastmcp, 28k stars), Xquik MCP (Xquik-dev/x-twitter-scraper, 209 stars), MCP Dart Streamable HTTP (leehack/mcp_dart, 116 stars) and Unifapi (unifapi-agent/agents, 586 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
vercel (a GitHub organization, an official publisher) maintains it in vercel/vercel-plugin, which has 301 GitHub stars. The repository holds 38 skills in this directory. The repository was last updated on October 6, 2026.
Source: vercel/vercel-plugin on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.