Qa Gate Vercel

This skill appears to do what it says (generate plans and run tests for a Vercel/Supabase/Firebase app), but there are mismatches you should resolve and safety steps you should take before using it: - Verify which environment variables are actually required. claw.json lists OPENROUTER_API_KEY, SUPABASE_URL, SUPABASE_ANON_KEY, VERCEL_TOKEN, but the registry metadata shows none — ask the author to reconcile and document all env vars. Expect additional vars like TEST_AUTH_TOKEN and VALIDATION_BASE_URL used by generated tests. - Do not provide production tokens. Create scoped, short-lived, or read-only test credentials for Supabase and Vercel and a dedicated OpenRouter/LLM key with limited quota for judge runs. - Inspect generated test files and the test-plan JSON before executing them. The skill will generate and then run tests that execute code from your repository; review for any unexpected shell commands or network calls. - Run first in an isolated environment (CI job, container, or throwaway branch) so tests cannot affect production resources or leak secrets from the machine. - If you need stricter controls, request the author to declare all env vars in SKILL.md/claw.json and add an option to only generate tests (no execution) so you can run them manually after review. Given the inconsistencies and the potential to run arbitrary project code, treat this skill as moderately risky until the above clarifications and mitigations are in place.