Clawhub Publish

Deploy to Vercel. Auto-activates for any Vercel task — editing a landing page, deploying, aliasing, updating a site.

This skill can deploy to Vercel but asks for your Vercel token and even shows how to read local CLI auth files. Before installing or using it: (1) do NOT paste your long-lived personal Vercel token into chat — create a short-lived or limited-scope token and revoke it after use; (2) prefer using your own browser-based 'vercel login' flow or a secrets manager rather than copying tokens into the agent; (3) ask the author to declare required env vars and config paths in the skill metadata so you know what will be accessed; (4) be cautious about the 'curl PATCH' commands that change project SSO/password/trusted IPs — verify them manually or run them yourself; (5) if you must use this skill, run it with a token scoped only to the project and revoke the token afterward. If you want higher assurance, request the skill author add explicit declarations for credentials/config paths or use a version that avoids asking users to paste secrets into chat.

Type: OpenClaw Skill Name: vercel-deploy-pro Version: 1.4.2 The skill contains instructions in skill.md to programmatically disable security protections (SSO, password protection, and IP whitelisting) on Vercel projects. It achieves this by using python3 snippets to extract sensitive authentication tokens directly from the Vercel CLI's local storage directory ($HOME/Library/Application Support/com.vercel.cli/auth.json). While these actions are directed at the official Vercel API, the automated extraction of credentials from local files and the disabling of security controls represent high-risk behaviors.