vercel-deploy

The vercel-deploy skill is part of the curated skills collection in OpenAI’s official repository. According to the provider, it helps a Codex agent deploy applications and websites to Vercel when a user explicitly asks for a deployment, a deployment link, a publication, or a preview. The skill is an operating instruction for an agent. It is not a Vercel account, not a hosting service, and not a replacement for Vercel documentation, project configuration, or human approval of external changes.

Purpose and operating principle

The source establishes preview deployment as the safe default. Production deployment should happen only when the user explicitly requests it. This separates the normal intent of a rapid feedback cycle from a publication with lasting external effects. The agent should derive the target project, requested path, and deployment type from the request and the available project context. When important details are missing, it should expose the ambiguity instead of silently selecting the wrong project or environment.

Prerequisites and workflow

Before the actual operation, the skill checks whether the Vercel CLI is available in the environment without using elevated permissions. The source then describes deploying with the available CLI and allowing an appropriate timeout because builds and uploads may take several minutes. If the CLI is absent or no existing credentials are found, the skill describes an alternative deployment through its included script. That fallback detects the framework, packages the project, waits for the build, and returns a preview URL together with a claim URL. These URLs are outputs of the specific operation and must not be invented in advance.

Boundaries and production protection

The skill draws a clear line between preview and production deployment. A production action requires an explicit user decision and should account for possible effects on availability, domains, data, and team access. The agent cannot repair faulty source code as a matter of engineering judgment, and a successful build does not prove that the application behaves correctly. Build failures, missing permissions, network problems, or an unavailable CLI should be reported as concrete causes. The provider recommends using elevated network permissions only for the actual deployment when the environment requires them because of sandboxing; the preliminary availability check must not be escalated in this way.

Security and data governance

A deployment can make project files publicly reachable and changes an external service. Before uploading, the target, branch or project path, build output, and deployment type should therefore be checked whenever the request does not define them clearly. Credentials, tokens, session keys, and environment values do not belong in skill text, logs, or version control. Secrets should be managed through the protected configuration of the Vercel project. Build artifacts, source maps, test data, local configuration files, and generated files deserve particular review. Using a local CLI does not automatically make processed files confidential, because the selected agent and its model provider may process file contents and command output.

Context and source quality

The primary source is the skills/.curated/vercel-deploy directory in OpenAI’s official repository. Its license file identifies MIT. Vercel documentation remains authoritative for current CLI features, authentication, project configuration, and platform behavior. The skill is useful for repeatable preview deployments and explicitly requested publications. It does not replace a CI/CD strategy, quality review, rollback design, privacy assessment, or checks of domain and team permissions. Current account terms and capabilities should be checked directly with the provider; this catalog entry therefore states no concrete prices.