deploy-to-vercel

An agent skill by vercel-labs, from vercel-labs/agent-skills. Tags: automation, developer-tools, devops, vercel, web.

What it does

Deploy applications and websites to Vercel. Use when the user requests deployment actions like "deploy my app", "deploy and give me the link", "push this live", or "create a preview deployment".

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add vercel-labs/agent-skills --skill deploy-to-vercel

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/vercel-labs/agent-skills
cp -r agent-skills/skills/deploy-to-vercel ~/.claude/skills/deploy-to-vercel

Safety box score

Grade F, high risk: 70 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill deploys projects to Vercel through git pushes, the Vercel CLI, or claimable fallback scripts. The main risks are broad network egress of the project source, external publishing actions, and a global CLI install path that changes the machine outside the project.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It runs multiple shell commands and ships executable Bash scripts (`git`, `tar`, `curl`, `vercel`, `npm install -g vercel`), so it can perform real machine actions beyond simple reading.
Network access	3 (high)	The fallback scripts POST a tarball to remote deploy endpoints and poll the resulting preview URL (`curl -X POST "$DEPLOY_ENDPOINT" ...`), sending project contents off-machine as part of the core workflow.
Filesystem reach	1 (low)	It mostly confines writes to the repo-local `.vercel/` config and temporary build dirs, with no recursive deletion of user files outside the project.
Secrets & credentials	2 (moderate)	It uses authenticated Vercel CLI state (`vercel whoami`, `vercel login`) and the git-push path stages everything with `git add .`, while the tarball path only excludes `.env` files.
Privilege & persistence	2 (moderate)	The skill can install the Vercel CLI globally with `npm install -g vercel`, which changes system-wide npm state and may require elevated permissions depending on the setup.
Instruction hijack surface	2 (moderate)	It repeatedly tells the agent to proceed without further confirmation in places like "Once the user picks a team, proceed immediately" and uses `-y --no-wait` to suppress prompts.
Irreversible actions	3 (high)	Its purpose is to publish/deploy externally: it can `git push`, run `vercel deploy`, and even use `--prod` when asked, so it can make a site live with real external effects.
Transparency	2 (moderate)	An included binary (`Archive.zip`) could not be read, and the `npm install -g vercel` path fetches unpinned code at runtime.

Before installing

Read `resources/deploy.sh` and `resources/deploy-codex.sh` first; they upload a tarball to a remote deploy service.
Check whether the repo contains any sensitive files before using any path that runs `git add .` or deploys the working tree.
If you do not want a global toolchain change, avoid the `npm install -g vercel` path and use an existing CLI instead.

Rated 2026-10-20 by an automated review of 3 files from the skill's repository.

Source

Repository: vercel-labs/agent-skills (all skills from this repository)
Path: skills/deploy-to-vercel/SKILL.md
Branch: main
Updated: 2026-09-19

hosted-agents — This skill should be used when designing hosted or background agent infrastructure: sandboxed execution, remote coding environments, warm pools.
devcontainer-setup — Creates devcontainers with Claude Code, language-specific tooling (Python/Node/Rust/Go), and persistent volumes.
stitch-loop — Teaches agents to iteratively build websites using Stitch with an autonomous baton-passing loop pattern
vercel-cli-with-tokens — Deploy and manage projects on Vercel using token-based authentication.
ci-cd-and-automation — Automates CI/CD pipeline setup. Use when setting up or modifying build and deployment pipelines.
cli-developer — Use when building CLI tools, implementing argument parsing, or adding interactive prompts.