← Back to Skills Marketplace
265
Downloads
0
Stars
0
Active Installs
7
Versions
Install in OpenClaw
/install vercel-deploy-pro
Description
Deploy to Vercel. Auto-activates for any Vercel task — editing a landing page, deploying, aliasing, updating a site.
Usage Guidance
This skill can deploy to Vercel but asks for your Vercel token and even shows how to read local CLI auth files. Before installing or using it: (1) do NOT paste your long-lived personal Vercel token into chat — create a short-lived or limited-scope token and revoke it after use; (2) prefer using your own browser-based 'vercel login' flow or a secrets manager rather than copying tokens into the agent; (3) ask the author to declare required env vars and config paths in the skill metadata so you know what will be accessed; (4) be cautious about the 'curl PATCH' commands that change project SSO/password/trusted IPs — verify them manually or run them yourself; (5) if you must use this skill, run it with a token scoped only to the project and revoke the token afterward. If you want higher assurance, request the skill author add explicit declarations for credentials/config paths or use a version that avoids asking users to paste secrets into chat.
Capability Analysis
Type: OpenClaw Skill
Name: vercel-deploy-pro
Version: 1.4.2
The skill contains instructions in skill.md to programmatically disable security protections (SSO, password protection, and IP whitelisting) on Vercel projects. It achieves this by using python3 snippets to extract sensitive authentication tokens directly from the Vercel CLI's local storage directory ($HOME/Library/Application Support/com.vercel.cli/auth.json). While these actions are directed at the official Vercel API, the automated extraction of credentials from local files and the disabling of security controls represent high-risk behaviors.
Capability Assessment
Purpose & Capability
The described purpose (deploy to Vercel) matches the instructions: uses the vercel CLI, .vercel/project.json, aliases, and curl to verify or change project settings. However, the skill metadata declares no required credentials or config paths while the runtime instructions explicitly require a Vercel token and reference local CLI auth files — the metadata/requirements omission is an inconsistency.
Instruction Scope
SKILL.md tells the agent to: ask the user to paste a VERCEL token into chat, export it into the environment for the session, and — separately — read local files (.vercel/project.json and a macOS CLI auth.json path) and extract tokens from them. Reading local auth files and requesting tokens via chat are sensitive actions that go beyond purely editing/deploying code and should have been declared and restricted.
Install Mechanism
Instruction-only skill with no install spec and no downloaded code; this is the lowest-risk install mechanism.
Credentials
The skill requires a Vercel token to operate (and the instructions show using VERCEL_TOKEN), but the registry metadata lists no required env vars or primary credential. It also instructs reading the local CLI auth.json to obtain a token. Requesting/storing tokens and reading local auth files is sensitive and should be explicitly declared and minimized (use temporary/tightly-scoped tokens).
Persistence & Privilege
The skill is not forced-always and can be invoked normally. That is fine by itself, but because the instructions request credentials and suggest pasting them into chat, autonomous invocation combined with credential access would increase risk — the skill currently does not request persistent privileges, but the credential-handling flow is a potential privacy/abuse vector.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install vercel-deploy-pro - After installation, invoke the skill by name or use
/vercel-deploy-pro - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.4.2
- Added a critical guideline: never output HTML in response text; always write HTML directly to files using the Write/Edit tool to avoid hitting token limits.
- Updated anti-patterns table to include the new HTML handling rule.
- Clarified instructions on editing large HTML files in logical sections.
- No changes to deployment, authentication, or post-deploy steps.
v1.4.1
Fix: vercel alias set (missing subcommand, would have broken alias step)
v1.4.0
Fix 4 issues: first-deploy flow, --scope team-only, Linux compat, token security
v1.3.0
Simplify auth: one-time VERCEL_TOKEN setup, no login needed after
v1.2.0
Add auth flow: CC uses vercel login, headless agents ask user for token
v1.1.0
Add final output rule: agent returns public URL as last message after deploy
v1.0.0
- Initial release of vercel-deploy-pro.
- Provides automated activation for any Vercel-related deployment or update tasks.
- Includes a clear pre-deploy checklist to ensure correct workflow.
- Step-by-step deploy recipe with shell commands and post-deploy verification.
- Guides for removing SSO protection and sourcing required account values.
- Highlights key deployment anti-patterns and common pitfalls to avoid.
Metadata
Frequently Asked Questions
What is Clawhub Publish?
Deploy to Vercel. Auto-activates for any Vercel task — editing a landing page, deploying, aliasing, updating a site. It is an AI Agent Skill for Claude Code / OpenClaw, with 265 downloads so far.
How do I install Clawhub Publish?
Run "/install vercel-deploy-pro" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Clawhub Publish free?
Yes, Clawhub Publish is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Clawhub Publish support?
Clawhub Publish is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Clawhub Publish?
It is built and maintained by ranlywood (@ranlywood); the current version is v1.4.2.
More Skills