Vercel Staging Workflow
v1.0.0Set up a staging/production workflow for Vercel projects using GitHub Actions and stable URL aliases. Use when asked to create a staging environment, set up...
⭐ 0· 66·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name, description, SKILL.md and the included GitHub Action template all align: they implement a workflow that waits for a Vercel deployment and posts an alias. The required GitHub secrets (VERCEL_TOKEN, VERCEL_PROJECT_ID, optional VERCEL_TEAM_ID) are consistent with Vercel API usage.
Instruction Scope
Instructions stay within the stated domain (Vercel + GitHub Actions). Minor points: SKILL.md suggests running `vercel link --yes` locally to populate .vercel/project.json (this requires the vercel CLI on the developer machine, which is reasonable but not declared as a required binary). The action itself uses curl and jq inside CI (ubuntu-latest runners include these), and it only reads the project file locally as a convenience step.
Install Mechanism
Instruction-only skill with no install spec and no downloads — lowest-risk install surface. It supplies a ready-to-use workflow file that the user copies into their repo.
Credentials
The workflow requires a permanent Vercel API token and project/team IDs — appropriate for calling Vercel's API. These are sensitive credentials; the skill correctly instructs storing them as GitHub secrets. Consider using the least-privilege token scope supported by Vercel, and avoid accidentally using a token that can modify unrelated projects.
Persistence & Privilege
Skill does not request persistent platform privileges (always:false) and does not modify other skills or agent-wide settings. It only provides a repo-scoped GitHub Action the user must add.
Assessment
This skill appears to do what it says: it provides a GitHub Action that polls Vercel for the latest READY deployment and sets a stable staging alias. Before installing, ensure you: (1) create a permanent Vercel API token with the minimum necessary scope and understand which projects it can modify; (2) store the token and IDs as GitHub secrets (do not hardcode them in the workflow); (3) set STAGING_ALIAS to a safe staging subdomain (do not accidentally use your production/custom domain); (4) verify the action's HTTP responses/logs after the first run and consider adding error handling or response checks if you need stricter guarantees; (5) be aware SKILL.md suggests a local step using the vercel CLI to obtain project.json — that step requires the vercel CLI on your machine but is optional if you obtain the projectId from the dashboard. If you need more assurance, test in a non-critical repo first.Like a lobster shell, security has layers — review code before you run it.
latestvk9714gxkg9cbv8rxmye2e8s59x83hm43
License
MIT-0
Free to use, modify, and redistribute. No attribution required.