Skip to content
anyai.fyi

plugin-audit

Skill from vercel/vercel-plugin

Security Worth a look curated contains scripts auditcodetest

Install

npx skills add vercel/vercel-plugin --skill plugin-audit

Runs the open skills CLI and installs the skill for your agent (Claude Code, Codex, Cursor …). Alternatively copy the skill folder into .claude/skills/ or upload it in Claude.ai under Settings → Skills.

As a Claude Code plugin

/plugin marketplace add anthropics/claude-plugins-official /plugin install vercel-plugin@vercel

This skill is part of the plugin “vercel-plugin”. In Claude Code the plugin installs it together with the plugin’s other skills, commands and hooks.

What does the plugin-audit skill do?

Audit vercel-plugin performance on real-world projects. Extracts tool calls from Claude Code conversation logs, tests hook matching against actual inputs, identifies pattern coverage gaps, and checks plugin cache staleness. Use when asked to audit, test, or investigate plugin skill injection on a real project.

Description from the SKILL.md in the source repository.

Works with Vercel

Questions about plugin-audit

What does the plugin-audit skill do?

Audit vercel-plugin performance on real-world projects. Extracts tool calls from Claude Code conversation logs, tests hook matching against actual inputs, identifies pattern coverage gaps, and checks plugin cache staleness. Use when asked to audit, test, or investigate plugin skill injection on a real project.

How do I install plugin-audit?

In a terminal: npx skills add vercel/vercel-plugin --skill plugin-audit. The skills CLI asks which agents to install it for. In Claude.ai you can upload the skill folder as a ZIP under Settings → Skills.

Which agents can use plugin-audit?

Skills use the open SKILL.md format, which Claude Code, Claude.ai, the Claude API, OpenAI Codex, Cursor, Gemini CLI and other agents support.

Is plugin-audit safe to use?

Our automatic check found patterns worth a look (see “Check”). That is not proof of anything bad – read the SKILL.md and scripts before installing.

Which tool is plugin-audit for?

plugin-audit comes from the makers of Vercel and helps your agent work with it.

More skills from vercel/vercel-plugin

queues
vercel/vercel-plugin

Vercel Queues guidance — durable topics with at-least-once delivery, independent consumer groups, retries, delays, and idempotency keys via @vercel/queue (JS) or vercel-queue (Python). Use when deferring background work, buffering traffic, fanning out events, or choosing between Queues and Workflows.

Development curated
No risky patterns found
vercel-cli
vercel/vercel-plugin

Vercel CLI expert guidance. Use when deploying, managing environment variables, linking projects, viewing logs, querying metrics, debugging a deployed app on Vercel (errors, 5xx responses, timeouts, slow routes, or a single failing request), managing domains, managing feature flags with vercel flags, or interacting with the Vercel platform from the command line. Use the vercel-tracing skill instead for `vercel traces` span search, trace inspection, and sampling rules, or for OpenTelemetry setup.

Research & Web curated
No risky patterns found
vercel-agent
vercel/vercel-plugin

Vercel Agent guidance — dashboard and Slack chat, code review, production investigation, approved actions, and product installation. Use when configuring or working with Vercel's AI assistant.

Development curated
No risky patterns found
runtime-cache
vercel/vercel-plugin

Vercel Runtime Cache API guidance — ephemeral per-region key-value cache with tag-based invalidation. Shared across Functions, Routing Middleware, and Builds. Use when implementing caching strategies beyond framework-level caching.

Development curated
No risky patterns found
routing-middleware
vercel/vercel-plugin

Vercel Routing Middleware guidance — request interception before cache, rewrites, redirects, personalization. Works with any framework. Supports Edge, Node.js, and Bun runtimes. Use when intercepting requests at the platform level.

Other curated
No risky patterns found
react-best-practices
vercel/vercel-plugin

Vercel's React and Next.js performance rules (70 rules in 8 categories ordered by impact - eliminating waterfalls, bundle size, server-side performance, client-side data fetching, re-renders, rendering performance, JavaScript performance, and advanced patterns). Use when writing, reviewing, or refactoring React components, Next.js pages, or data fetching for performance. Not an accessibility or TypeScript style guide.

Frontend & UI curated
No risky patterns found
microfrontends
vercel/vercel-plugin

Guide for building, configuring, and deploying microfrontends on Vercel. Use this skill when the user mentions microfrontends, multi-zones, splitting an app across teams, independent deployments, cross-app routing, incremental migration, composing multiple frontends under one domain, microfrontends.json, @vercel/microfrontends, the microfrontends local proxy, or path-based routing between Vercel projects. Also use when the user asks about shared layouts across projects, navigation between microfrontends, fallback environments, asset prefixes, or feature flag controlled routing.

Other curated
No risky patterns found
knowledge-update
vercel/vercel-plugin

Corrects outdated LLM knowledge about the Vercel platform and introduces new products. Injected at session start.

Other curated
No risky patterns found

Related skills in Security

accessibility-audit
Noibu/ai-plugin

Audit a website for WCAG 2.1 AA accessibility violations using automated scanning and Noibu traffic data, and optionally draft the fixes. Use when you want to know what's inaccessible across the store, check WCAG or ADA compliance, find contrast or heading errors, audit for screen reader support, generate an accessibility report, or fix accessibility violations with pull requests or tickets.

Security curated
No risky patterns found
aidp-audit
oracle-samples/oracle-aidp-samples

Manage and search AIDP audit logs — enable/disable auditing, set retention, and query audit-log entries for a DataLake. Use when the user asks about audit logging, who did what, compliance/retention of AIDP activity, or wants to search audit events. Self-contained — official `aidp audit` CLI preferred, `oci raw-request` fallback.

Security curated
No risky patterns found
snowflake-assess-estate
oracle-samples/oracle-aidp-samples

Read-only PREVIEW of a Snowflake environment from the operator's machine - inventory of tables and views with row counts, byte sizes and column types, plus the census of objects that are not tables or views, table-maintenance state and security posture. Use ONLY when the user wants to look at an account without migrating it - answering what is in there, how big the tables are, what the security posture looks like. This is NOT the discovery step of a migration: a migration discovers inside AIDP as a workflow (runbook S6), because a laptop-side read leaves no log and no evidence on the platform. If the user asked to migrate, route to snowflake-migrator-overview and follow S1 through S12.

Security curated
No risky patterns found
snowflake-migrator-bootstrap
oracle-samples/oracle-aidp-samples

First-run setup for the Snowflake to AIDP migrator. Finds or creates the one migration config file (snowmig-config.yaml), reads every field back with secrets masked, verifies Snowflake authentication by password, key-pair, programmatic access token or SSO, verifies the AIDP end, then smoke-tests the connection and reports the account, region, role and warehouse. Use the first time the migrator runs on a machine, or when any other stage fails with an authentication, connection or "no config found" error.

Security curated
Worth a look
aidp-snowflake
oracle-samples/oracle-aidp-samples

Read Snowflake from an AIDP notebook through the AIDP `aidataplatform` Spark format handler. Use when the user mentions Snowflake, Snowflake warehouse, Basic authentication, KeyPair authentication, private.key.file, or private.key.content. Snowflake writes are not supported in AIDP 4.0.

Security curated
Worth a look
troubleshooting-connection
wingspanHQ/mcp-claude-plugin

Diagnose Wingspan connection and permission problems. Use when a Wingspan tool returns an authentication or permission error, when the tools report nothing at all, when an answer looks like it came from the wrong company or the wrong account, or when someone asks "am I connected to Wingspan", "is my login still valid", "why can't Claude see my contractors", "why is this empty", "these are not my contractors".

Security curated
No risky patterns found
computer-health-check
wonderwhy-er/DesktopCommanderMCP

Run a comprehensive, read-only health check on the user's computer and return a scored chat summary with prioritized, plain-English recommendations and safe cleanup suggestions. Use this whenever the user wants to check their computer's health, speed it up, free up / reclaim disk space, find what's eating CPU / memory / storage, check battery health and wear, audit login & startup items, see pending updates, or asks for a "tune-up", "checkup", "system report", "health check", or "is my Mac/PC/laptop healthy". Trigger even on casual phrasing like "my laptop feels slow", "why is my fan so loud", "my computer is laggy", "running out of space", or "clean up my machine". Works on macOS, Windows, and Linux. This is a Desktop Commander skill: it relies on a real local shell (start_process / interact_with_process) and is strictly read-only by default — it never needs sudo and only performs cleanups the user explicitly approves.

Security curated
Worth a look
runai-audit-assigned-quota
NVIDIA/skills

Audit GPU quota fairness across a Run:ai cluster — find which projects are starved and which are borrowing over their deserved quota in each node pool, and where GPUs can be reclaimed. Use when an admin asks "who is over quota in node-pool X", "which projects are starved", "is the cluster shared fairly", "where can I reclaim GPUs", "show deserved vs allocated by project or department", or when a team reports it can't get GPUs and you suspect unfair borrowing. This is the quota / fairness axis (deserved vs allocated). For idle-but-held GPUs use runai-get-utilization-overview; for a health/scheduling verdict use runai-get-cluster-health-summary.

Security curated
No risky patterns found