vercel-cli-with-tokens

An agent skill by vercel-labs, from vercel-labs/agent-skills. Tags: api, automation, cli, developer-tools, devops.

What it does

Deploy and manage projects on Vercel using token-based authentication. Use when working with Vercel CLI using access tokens rather than interactive login — e.g. "deploy to vercel", "set up vercel", "add environment variables to vercel".

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add vercel-labs/agent-skills --skill vercel-cli-with-tokens

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/vercel-labs/agent-skills
cp -r agent-skills/skills/vercel-cli-with-tokens ~/.claude/skills/vercel-cli-with-tokens

Safety box score

Grade D, elevated risk: 49 of 100 risk points, rated 2026-09-22. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill manages Vercel projects from the CLI: it reads tokens from the environment or `.env`, installs the Vercel CLI, deploys builds, edits env vars/domains, and can push git commits. The main risks are handling local secrets, making real changes to Vercel resources, and the outbound network/global-install side effects of the CLI workflow.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It runs shell commands throughout the workflow, including `npm install -g vercel`, `git push`, and multiple `vercel ...` CLI invocations.
Network access	2 (moderate)	It depends on outbound network access to npm and Vercel, and can also `git clone <repo-url>` and query deployment/log data remotely.
Filesystem reach	1 (low)	It reads `.env` and `.vercel/*` files and can create `.vercel/project.json`, `.vercel/repo.json`, and `.env.local`, but stays within the workspace.
Secrets & credentials	2 (moderate)	It explicitly reads `VERCEL_TOKEN` from the environment or `.env` and tells the user to provide a token if none is found.
Privilege & persistence	2 (moderate)	The setup step uses `npm install -g vercel`, which modifies the user's global Node toolchain and PATH.
Instruction hijack surface	0 (none)	There is no hidden prompt-skipping or instruction-hijacking content; it even says `Ask the user before pushing to git.`
Irreversible actions	3 (high)	It can deploy preview or production builds, push commits, add/remove environment variables, and add domains, so it can make real external changes to a Vercel project.
Transparency	0 (none)	The skill is plain Markdown only; there are no binaries, bundled installers, or decoded-at-runtime code.

Before installing

Confirm you are okay with the skill reading `.env` for `VERCEL_TOKEN` and other Vercel-related values.
Check that preview-only deploys are sufficient for your use case and that any future production deploy or `git push` will be explicitly approved.
Run `npm install -g vercel` in a disposable shell/profile first if you do not want your global Node toolchain changed.
Review whether `vercel env rm` and `vercel domains add` are acceptable actions for your Vercel account/team.

Rated 2026-09-22 by an automated review of 1 file from the skill's repository.

Source

Repository: vercel-labs/agent-skills (all skills from this repository)
Path: skills/vercel-cli-with-tokens/SKILL.md
Branch: main
Updated: 2026-09-19

cli-for-agents — Designs or reviews CLIs so coding agents can run them reliably: non-interactive flags, layered --help with examples, stdin/pipelines, fast actionable errors.
devcontainer-setup — Creates devcontainers with Claude Code, language-specific tooling (Python/Node/Rust/Go), and persistent volumes.
gh-cli — Enforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns.
modern-python — Configures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black.
deploy-to-vercel — Deploy applications and websites to Vercel.
atlassian-mcp — Integrates with Atlassian products to manage project tracking and documentation via MCP protocol.