Vercel Optimize

Before you start: read this whole install prompt, tell me in a few lines what this skill does and what installing it involves, and wait for my go-ahead before you do anything else. Prerequisites — Nothing to install the skill itself — no account, no key, no payment to copy the folder, and no script in it is run during installation. Use-time requirements, stated up front: a Vercel project linked with vercel link, an authenticated Vercel CLI session (v53 or newer, with vercel metrics, vercel usage and vercel contract), Node.js 20+, and Observability Plus for route-level, metric-backed recommendations — at use time the skill collects my linked project's metrics, usage and contract data through that CLI on my own account, and scans only the files its gates name. The SKILL.md explicitly forbids putting auth tokens in shell commands (no VERCEL_TOKEN=..., no --token, no Authorization headers in commands): authentication stays in the CLI session. Install "Vercel Optimize" for me. It runs an observability-first cost and performance audit of a deployed Vercel project: first it collects production signals (metrics, usage, plan and project configuration) through the authenticated Vercel CLI, scans the codebase, and merges the signals; deterministic gates then decide which routes, files or settings deserve investigation; only candidate-bound files are read closely; recommendations are mechanically verified against files, citations and framework version before a ranked report is rendered, with cost framed as magnitude, never as precise dollar savings. Its folder holds the main SKILL.md (frontmatter name vercel-optimize), an AGENTS.md entry point, a README, a CONTRIBUTING file and metadata.json, 15 Node scripts under scripts/ (signal collection, code scanning, gating, deep dives, verification, report rendering), 75 library files under lib/ (metric queries, gates, codebase scanners and output sanitizers) and 61 reference files under references/ (doctrine, data collection, scoring, verification, playbooks per project type and support topics). Repository: https://github.com/vercel-labs/agent-skills (the skill is the whole skills/vercel-optimize/ folder at the pinned commit: SKILL.md plus 155 companion files, 156 files in total) Pinned version: install the code at commit 063bee94c3f4df8453406c830b0a7df0f2860278 exactly. Do not substitute a newer version. If this commit is unreachable, stop and tell me. 1. Clone https://github.com/vercel-labs/agent-skills into a temporary folder, check out commit 063bee94c3f4df8453406c830b0a7df0f2860278, and copy the skills/vercel-optimize/ folder from that checkout. Then compare every file in the folder with the fingerprints recorded for this listing on 2026-10-22: [FINGERPRINTS] - AGENTS.md: SHA-256 922a35993ffd98c923d61fa3d7a722bc1bc17466ea1e0b5828f67de21fbb0e7a - CONTRIBUTING.md: SHA-256 4a3c6695f23ada3228582f1062509545dbad485e5011434c12b7ddd81bf1370a - README.md: SHA-256 4ebb0ae7c6a2c8cfe7ed8ad26a6bee0be99d8682be331d9d28c1cb81ad3718d0 - SKILL.md: SHA-256 95ae2683b30d892d165af92a350c5628b68106f395a59b448857b654e306ed91 - lib/auth-route.mjs: SHA-256 c06a222bccd2c57b418b1d935d73f5b81297dac8533c004ec5bb4027cec3307a - lib/budget-summary.mjs: SHA-256 8662a2914940b8c548be164c09ce7706ea261549fb61147d2a7a13af1e3337cc - lib/citations.mjs: SHA-256 41a1bafa7addc4b39d144491f178a159cc23ff779b4803f2c152fe579209b384 - lib/cost-coverage.mjs: SHA-256 483b0f03f5db08e15388e1c047ffad414bb132bb3ce48418defc0d9a70a20e44 - lib/dedup-recs.mjs: SHA-256 5fc631c1f56eea8bf8c59afb773511d9a8f42d29574fa14f03abb60c881206cc - lib/deep-dive.mjs: SHA-256 c86c5ed224c00c2e72a54eef16260b8e7237302a7e69e47310077eae7f65ced1 - lib/display-labels.mjs: SHA-256 e56e54a0e19ed3ed4f45112cb358c1df5a77caa7411f5c2267c73064f64d1b08 - lib/extract-claims.mjs: SHA-256 a3f44334dad0ba743699860d6b83a06e38c7e465f73418749822cf00d563ee2a - lib/framework-support.mjs: SHA-256 ed8ef73604d5bd91f4aea6fb0de465079474e00299c23bbdba8b04dd70545364 - lib/gates/build-minutes-fanout.mjs: SHA-256 c088ab1f91af8b4e86e8f3f3210c7b625757a3699bd5818c905f66ade92064b1 - lib/gates/cold-start.mjs: SHA-256 40023aae34ebc37df1382c7c4c00efc3864b2c11a8c9ee8cf05f371762680300 - lib/gates/contract.mjs: SHA-256 e0bd012b53b6a70684279a3ad58598f5a1f79698d0e521d0e9d0994e87b3ae65 - lib/gates/cwv-poor.mjs: SHA-256 17ab4ae24b5d0220d941215db8544bed68c1af02e6d5d7aba4ff077a46675fbb - lib/gates/external-api-slow.mjs: SHA-256 12ce4f0cf906e5631170a58307758f095069d3051c16f64ddeec00bb99a66dc9 - lib/gates/hard-gates.mjs: SHA-256 b31d94495e20721b8ce825bde073ba9a32c14063b0cc711e23e2582fb0ebd677 - lib/gates/index.mjs: SHA-256 d473dfce777f68430d2b68836efb184152a59da97d3b06d37a6f618c7d4c59a6 - lib/gates/isr-overrevalidation.mjs: SHA-256 333d2dc8523d5850fddb5c13cd78fe62c0838ffd627c41b374804dca26cc63c6 - lib/gates/middleware-heavy.mjs: SHA-256 1ad98bc73be97254d6131707ed93c72262c071e54ce071a392549df33d0d7ae7 - lib/gates/observability-events-attribution.mjs: SHA-256 8e465217257c771c0be8580c1b9abcf1defd26e5a70c9559dc10f4cc45527c52 - lib/gates/platform-bot-protection.mjs: SHA-256 0124cd71876616f7de741d962ff4cbcb79a78654a3026372a18195e2ff99294b - lib/gates/platform-fluid-compute.mjs: SHA-256 de81279134bef9499f1cbe2f38d06bb5caa968daa5438f09c9bad0d2f27efa96 - lib/gates/region-misconfig.mjs: SHA-256 0b3976cd50a9fb54601c60ad27c62b64aa7a4eeb338af4226b618ae1d5a9cc4a - lib/gates/route-errors.mjs: SHA-256 a32a29b683557409b351da84e45ab316818f8a90c5af380ba7efc5366c03129f - lib/gates/scanner-driven.mjs: SHA-256 485313169d009ded7bdb1e4083150919e77eb4373aff0252cd5c0c235f2e8f3b - lib/gates/select-candidates.mjs: SHA-256 bde0714be600905caaaa99991d37c31df9e6775b8a107ee2df5eb63ffa9d1e11 - lib/gates/slow-route.mjs: SHA-256 b0d330e4244bd3d2e240f6398ead4b235bb69b72fe585771cde4f11ae8726148 - lib/gates/types.d.ts: SHA-256 097ea533204446ccc18798fc01656577df8b864c24b0eda4c66ebc913fa36f31 - lib/gates/uncached-route.mjs: SHA-256 c4f89fa083f13a9360dd5ec6b45b39db3f480c797193c590bf131f53463388cb - lib/gates/usage-spike-triage.mjs: SHA-256 b8f84b57fe9d41323467c765ef9da4893b0cac6eee31603179cd8cb77ffd7be3 - lib/grade-recommendation.mjs: SHA-256 e06008677dd1c6a27d767636356b6a68f357a3122b57adca3238bd2ca7576c38 - lib/impact-label.mjs: SHA-256 4d55baae79025bfa43b829ff291019bb6a1f6d015c72dd44612d8e3afeb60b9f - lib/impact-magnitude.mjs: SHA-256 a87cec394f9d853da43e633e8ce2cb9f1f62fb2ae7dd6a58f542a5e7024b2c5b - lib/investigation-brief.mjs: SHA-256 f41d9354992fb5c7904b8faa1ad1fa457f8b69533d2113ec9c38192c227bf0c7 - lib/observation-safety.mjs: SHA-256 540a4c49f10ceab570513f2834b7fbd88b2090c85690ed0f8b5c5bf0e623badd - lib/project-facts.mjs: SHA-256 d8b508d1077fdb4bcf5c2f267750cb4a6ca529811eecdadb10f9e632e304f30b - lib/queries.mjs: SHA-256 a747292c7bbc69a245799f846c6d081df44506c5c8e3d245b610c0f32edcea69 - lib/reconcile-candidates.mjs: SHA-256 4e02dbc4fba1834192f018b05e9d42723fda13dbecf26a7cc09eacbfe1925b75 - lib/render-report.mjs: SHA-256 35068fb5df2f2b9a89cabf40e050c40da5d8fadeec33cdbd47c8fc995677a127 - lib/repo-root.mjs: SHA-256 77ce8277fa444dea77cb10c17e7a0d2db98a6cbea6e2df0fa2ff01372b52eb0c - lib/route-normalize.mjs: SHA-256 a2e39b3f653695392f096c1b385e31a9b1452714de4908c1d0e6604626274b5d - lib/sanitizers/bot-protection-certainty.mjs: SHA-256 2edac6df3f4565ec7d2f784db7e660767f8a213bfe9f55f6da14f2517f4a071a - lib/sanitizers/cache-tag-invalidation-certainty.mjs: SHA-256 31aec0481e996fd2a9a546c792ff17223747c850806405b2ee3cb95c40e296c0 - lib/sanitizers/count-correct.mjs: SHA-256 cf427876a8c64d9591d89da727a2d4cec9dc0dcd717ffba3f82be52c38c73de3 - lib/sanitizers/function-duration-invocations.mjs: SHA-256 c745bc90e67722f8584d3d426f28ccc4701504a635dd966cdb8f487ee79eb7b3 - lib/sanitizers/index.mjs: SHA-256 99babb880c7d5e7ac209e7eb1bf26f2ae9ac5a795062d01e15d76c57055247bf - lib/sanitizers/middleware-conflict.mjs: SHA-256 89fae25e31662ed7f31fef973e7b969271fc061839112adabf253a3e87380b97 - lib/sanitizers/missing-citation.mjs: SHA-256 431ec0944239d4477556a23808733298ecd5bdfb4a810ab887b83f0266eb5904 - lib/sanitizers/pre-release.mjs: SHA-256 dce1475fd392d245bd4a48e1280c2f0a00fc4dea96cd9f40e4d260fdc0bf5940 - lib/sanitizers/rate-limit.mjs: SHA-256 42b2a3ecb07443ab5aeb881ab6dea31a92f767b73697fd0529e877084657629c - lib/sanitizers/rendering-mode-mislabel.mjs: SHA-256 410c60d8f71250d8b443384098f02869e7a1b4d9dcb3e3ca384ca3b875648788 - lib/sanitizers/undeclared-dep.mjs: SHA-256 bc2a483311a2c44103b15d9498b5d303101724454c114907d23de6d7725e8769 - lib/sanitizers/vercel-directive-strip.mjs: SHA-256 b94a6fcd0a03358dcb853b04a392b0946d8a07d8619e86b562b8b38a6cffac85 - lib/sanitizers/window-units.mjs: SHA-256 f7823f1c4705166c313107571f048fd4e7fa160cb982dcbfe07d936ab4cb5a3b - lib/scanners/cache-components-suspense-dedupe.mjs: SHA-256 ca4c643a30b76df0e8728f8b8854167483f746a9d45aafb467c3bec9125b7878 - lib/scanners/edge-heavy-import.mjs: SHA-256 0faacf202542cc6ea37290377a61e9c34a84d3d9439822cd7df09d450ff663a3 - lib/scanners/force-dynamic.mjs: SHA-256 5f378119f8e6d1961cde57dcd6ccd193cc4a9713068d4828ca4eee724b15095d - lib/scanners/headers-in-page.mjs: SHA-256 84f72dcd79631561fa54f6a5128337b6b9317bc9b7c720b709078cf0c2758e7d - lib/scanners/index.mjs: SHA-256 9443d7e055a4b8368973c027b739742bbf5e98de4dbc5078c4cd7fb2677aeeb9 - lib/scanners/large-static-asset.mjs: SHA-256 5ee29065ae96b7aff236dd3ea9766765a7c48e1bd95008e261837ae42932b783 - lib/scanners/max-age-without-s-maxage.mjs: SHA-256 ec722b65530f428232f2b501f5f52e427cd7218c51cceb4783b5f7b03c3ad577 - lib/scanners/middleware-broad-matcher.mjs: SHA-256 e41e07c4fb8d0b6776e5f27609e719ae42c1644b7adcfa2dc1abc90a511c0492 - lib/scanners/missing-cache-headers.mjs: SHA-256 cc4ccea4c4f1d8594a97b18ca39b5212060faa3306dccdea0b2c7645d3f3cf8a - lib/scanners/prisma-include-tree.mjs: SHA-256 ab107e2732ca1873b4e4ce974e9c08b6ebde83a8f96675b96087213b16aa901e - lib/scanners/region-pin-in-config.mjs: SHA-256 906f33c344c98910f1148c86a9c5cd5cfbaf84cc8c06d02e3eb257ecd639b0d3 - lib/scanners/source-maps-production.mjs: SHA-256 f9ab9cf88a22a4c0fa32f73ac39243b6f61a868b81ca55f804d8c33a9341013c - lib/scanners/sveltekit-prerender-missing.mjs: SHA-256 ff5380fa9d8a3e77d8ff430e1b7866a0890b50d163bcc2a599f0b30238947999 - lib/scanners/turbo-force-bypass.mjs: SHA-256 b84a7774f18e1ea86cb19335fd41324b89635ccb43b75f31e0218516fd9363d2 - lib/scanners/unoptimized-image.mjs: SHA-256 f2049c073b769838e33f6110f8f139cacd1e8b8a01eda1473ebed0a14ec64b4f - lib/scanners/use-cache-date-stamp.mjs: SHA-256 2d04abd40b888e8c16bccee92dc3423ab86b109551cfab8807367d9cc8ca0878 - lib/support-topics.mjs: SHA-256 c9ac60070df4e6707299da5ab0d72a9853659ddfcfd4dca29f5803ef3ce41840 - lib/throttle.mjs: SHA-256 1d09d586071838152fe28882cd65f508a508ecd99b59187c84f27b908cc18017 - lib/util.mjs: SHA-256 431eb675f0a658e19a1b08cdb064e19f96a62d42a35c5f4d962756c8cf97d523 - lib/vercel.mjs: SHA-256 01a7bd818b64bd26143f93e4417f6463199a81c154854e9c60d2fcce3aea2e82 - lib/verify-claim.mjs: SHA-256 b7956b5e96e0be7e4ed7a107541d5e4ea11475f9b4e7829c4035769d3a879f71 - lib/workspace-resolver.mjs: SHA-256 9da10f288418475ab871b5430de38d4b97441794373721844cb540e40986e74c - metadata.json: SHA-256 729f7dcb13ebac414d54232e56acaeae4f7ded041947805a0b30a5d8fee59511 - references/candidates.md: SHA-256 1e04722b3924a11a774d87abbf35070cdf480ad02c8487f97a3dd69bb46b59af - references/data-collection.md: SHA-256 dbc013dfc59c29f38f279fbbb422f19d7cc1ba37d17ee02d9c64ea6cb594bd22 - references/docs-library.json: SHA-256 287d4dabbb3eab789911a6c2b4aea9ffc57206fa4a8449636358503e32b9542c - references/doctrine.md: SHA-256 4a7eac752141410d134febe786c4b51f4723a55026a5638c38fcb492a1d86df4 - references/observability-plus.md: SHA-256 86b6f6d5bd7f4b9827f70505705ed0f875a0ef2e2cdb85653f0e09f825393333 - references/playbooks/README.md: SHA-256 9b699bb8d2436b089ced036780cbc108502f3713b15f83440fd042e393487cf3 - references/playbooks/ai-application.md: SHA-256 e9e353a3f7d5c576e14893ebb0e1eddaa90ee986f0ef3d9edb3be73a2e947ac9 - references/playbooks/api-service.md: SHA-256 f90e2d558ea697dc06f05794ad47770f379e3268321ab8a6a642abd7f2fa7ed3 - references/playbooks/content-site.md: SHA-256 9d4b1a7d1c6eb6f58e94c5df5dc8264c5bd6c877f045c7c81228924cbadc9d37 - references/playbooks/ecommerce.md: SHA-256 f44707fac676e67de04b7ddb2f78bc806f286cd324d05d990641acef3097a0e9 - references/playbooks/marketing.md: SHA-256 b7e0ed3de01e95f7776891b6a63e0d2929b066c61ccd9b8ac012b42cbc3e4a19 - references/playbooks/saas.md: SHA-256 f23b518dd7c369144813f80abe6eba3e762db3b737b3271bb8b887307fcec387 - references/playbooks/sveltekit.md: SHA-256 32db0a70f1217c2e3f750ef5e5671da54a07a510369307e38877e3fd3ad21767 - references/recommendations.md: SHA-256 8e65890c1afd942f4bf9dd07ba538b2b9f53a6136ec83e96cc10740c6f8dda87 - references/scanner-patterns.md: SHA-256 e160869045f6456d10bd4f1fdeff76d42d8b3e0c50a7212a607603589798bcaa - references/scoring.md: SHA-256 44a295b6c65ee5c221815149c7fad1adb02c8ac8750d0604a8dfbfe47d04b6d6 - references/support-topics/README.md: SHA-256 63e2acd6e221ca52355a5f70ff8d9c3d9704600eb7e176d3cb2f4597ad03db4b - references/support-topics/astro-edge-middleware-scope.md: SHA-256 80586e0b110749f2cdd6e56635d6cd88082230b9bd11a8e388ec6d3b280bc65d - references/support-topics/astro-output-mode-and-isr.md: SHA-256 6137553e35076795f6c0851b0e93d4686cf937930d35b284567da7c0edfe35ba - references/support-topics/auth-preserving-parallelization.md: SHA-256 34cfd687cc106ef15696b8f1f155c30f635234e29f3c4db087193c3c2c3c4bac - references/support-topics/bot-protection-product-guardrails.md: SHA-256 892d8f32deb5bded86863a513d3799bfd81dc4654ae4fde5a264638cfd86755d - references/support-topics/build-minutes-monorepo-fanout.md: SHA-256 1f54f0ba4d1b2ab873eb166ca2f1661d39b49e70253dea8ce13a44c2b728ba85 - references/support-topics/cache-components-static-shell-boundaries.md: SHA-256 664a13ced4e985e9b12bdf6730fecccfd79fb715be2998a710068384a0ab4cc0 - references/support-topics/cache-components-suspense-dedupe-pitfall.md: SHA-256 212f1bedf49c9a1e7aac7745c5b19f57c486456d5e4ef9037fa9689f51930047 - references/support-topics/cdn-cache-auth-safety.md: SHA-256 5691cd39b3403ef939199c3b9b21e28cb447b2f8d2f6dea6000064e5ef3fdfb5 - references/support-topics/cold-start-initialization-bundle.md: SHA-256 98961df48eac648e71c73b7dd53a215ac02af62f0bfbc67a1af335e66b8fb7c1 - references/support-topics/core-web-vitals-client-bottlenecks.md: SHA-256 05d84906be0f1e26787e871c00cd563f18533a7b12d3383c5cb3557fe01ea768 - references/support-topics/database-egress-pooling-region.md: SHA-256 83fa0f1a3ff67b9f149ba39432834bba88437dbdf09d6b5e7a5e3b552ceb473e - references/support-topics/dynamic-rendering-traps.md: SHA-256 a075a13fc3c40d7d249051519cf2384497a34f3f4a207f757bf4343c3896fd64 - references/support-topics/external-api-critical-path-platform.md: SHA-256 02a7a7e3ba867973c9e45d565e69349cd44a5bdb9e00e6fbbf9c76edd01516e5 - references/support-topics/external-api-critical-path.md: SHA-256 dade955ceba21150590f8606b993881d6f6b20fef32c147b77ce26d9e9931773 - references/support-topics/fast-data-transfer-payloads.md: SHA-256 d7daca1a05d8f3157aab22b97552247cb0a8f856f08fc49079fd76872f7a50fa - references/support-topics/fluid-compute-caveats.md: SHA-256 3408a19b49a9723cfac1b461babe56dc414f0f1f7561bd7e6f4f7579ab26a13f - references/support-topics/function-duration-io-and-after.md: SHA-256 693c07390d7cf8b4c0a0d0235176a5f452694d1553c33db4fd385f76c94d307d - references/support-topics/function-invocation-reduction.md: SHA-256 1e50e0e24299fc08aaf6b81d6673ce24c0bc250883c8ecc76e52d6d1dca989a9 - references/support-topics/function-region-misconfiguration-ttfb.md: SHA-256 dd5013cf9bd5b3ee7383d3b9835babc6a93b965e07b7093f48d53ce755510326 - references/support-topics/image-optimization-cost-control.md: SHA-256 1123f4712ec4a4ff057dadbee25f7de51bc8473862dbb398693f9c091336681c - references/support-topics/isr-revalidation-static-generation.md: SHA-256 fafc8585a02b2142b60289177b041d63e1280d1fdccd38a2faa2e89d7c1950cb - references/support-topics/middleware-proxy-edge-cost.md: SHA-256 d1c6f3b0f4ecf3c4d430c2ae3999c9485e8f2115e40d9ba973b637541a5a5f32 - references/support-topics/next-fetch-revalidate-floor.md: SHA-256 65897b4111c75457e1fbe16ce6f9716c5fd58365d8defaeb80b5ea0ca4f2a3b0 - references/support-topics/next-font-cls-self-hosting.md: SHA-256 a06d7f692fc902f41a227f5acb20d694e2d47c3098b1fba354b5413e7df32964 - references/support-topics/next-heavy-ui-lazy-load-boundaries.md: SHA-256 f48f1f61626aa313b3e08a6e43a5550bddef278f5c6aa4093b52bee1e9e1d78b - references/support-topics/next-image-lcp-preload-sizes.md: SHA-256 f176647780339cbd409897cbbaa8666f0dc7c301905651ad39b7feb2a0696a89 - references/support-topics/next-route-handler-get-cache-defaults.md: SHA-256 2f7e29b85cc1a8a31db214f59524035d3486c3a26c9fb9a39d62f3b834ee0f0c - references/support-topics/next-script-third-party-strategy.md: SHA-256 413fb8dfdb561ccb5073c89b93c0e28420cfa5125bff89317c699167c3b2f35a - references/support-topics/nextjs-version-cache-semantics.md: SHA-256 e8bf6e27e63841bb49c44e8d0e93d674866ba28f6217d41d5c4de2b51178b8dc - references/support-topics/not-found-catchall-request-waste.md: SHA-256 88a9bf8ec200182534957603bda8c3bcc8d9dce8d884ea19c890994424827ab8 - references/support-topics/nuxt-route-rules-cache-isr.md: SHA-256 639b0a57b50813bfea7f1734a2cb883d8fb756c86a3a4460e08e899d04323cbb - references/support-topics/observability-events-cost-attribution.md: SHA-256 60b2aea01836d6554b07cc79c9d8d64a4430782a2a4cec2ccd43ad957d69658e - references/support-topics/post-response-work-waituntil.md: SHA-256 da5ff4b2d2a714bc06d2cc4b442e77840b89f9e72e171ec33af4fb95cac8ab26 - references/support-topics/route-error-durable-offload.md: SHA-256 2ff21304503673bbeb656d92fd9841f8aa874cd93a5428f14a0f9abb55e49b65 - references/support-topics/route-error-runtime-limits.md: SHA-256 e4a70ec3e1112c658e1ce136359c00fcb6c9fb484887efafb3ba3364ebdb70a6 - references/support-topics/runtime-cache-reusable-data.md: SHA-256 cf59ca89dbfa178d371435e0aa7f5c588c2fc3114b4574049b4d644c63628911 - references/support-topics/sveltekit-isr-prerender-safety.md: SHA-256 909357c83a7718865cf5e1056653117f08df0042416e17050f22eae7900dfa49 - references/support-topics/sveltekit-split-cold-start-tradeoff.md: SHA-256 e61fee58a22120acbdfafb2559959749806cf2c1ad242749d30ad6d9f533d5f6 - references/support-topics/usage-spike-triage.md: SHA-256 850ce351c3cbff86a321b349eaa82330a29e08b78a3d255150dc290a7d095015 - references/support-topics/use-cache-date-stamp-isr-write-amplifier.md: SHA-256 45d5381f890b552dd672f6577aad203630f9f0e3caf04f3f2170726c0cea86fb - references/support-topics/use-cache-remote-shared-origin-data.md: SHA-256 4e8590e6c3ed65e5ec8811cfad82fcecf3cf5ac797e446bbf00e4498bd7e0d68 - references/support-topics/workflow-resumable-stream-routes.md: SHA-256 07145dac55800c709a57a1abfbe29e1764ecd6371ff05f342c8f73f69d101257 - references/verification.md: SHA-256 db3ffb183ae3c141eeb980ea3765ff215da01eb4bb8b569c7f86868ec3cfe5a1 - references/voice.md: SHA-256 1bd89b7f12f8ce912d0381b9ca7c251f8183f69bae0abf0021391e8397dfef11 - scripts/budget-summary.mjs: SHA-256 4dc6cb8ab9278ac9196e4cd70c36ecc1ffe2afeaffe09e99e562de42e62f94ea - scripts/build-docs.mjs: SHA-256 ce426e5bb4a803b86981588b733fc97aff13fea1c393d6d6559b97518df31ad8 - scripts/check-citations.mjs: SHA-256 47acb1d9deba97531ad46ef81cccaa9349bec4a3cf57d8fdc2bd601411b57fdb - scripts/check-docs-fresh.mjs: SHA-256 6c47f5595c6e317426606d67afa53d52d822fcc071fee27885cc25df38e7949e - scripts/collect-signals.mjs: SHA-256 bc1dcba99aa20ad7863450bc1a336d0ec8d78aac0f3f26f8b6be9183e52e944a - scripts/collect-sub-agent-outputs.mjs: SHA-256 21bd960b11c75711e1f51cb362efb5243f19bc8db65a3bfdab48549bb47bf9fb - scripts/deep-dive.mjs: SHA-256 f90c74b28a1a1580a45d7d12ab64f683c8c6f1b59d32aa7299980e74980550aa - scripts/gate-investigations.mjs: SHA-256 b30d756a3af5bc1170e4eec95e2fca7241999a516d8871497bd4e5a1cd681535 - scripts/merge-signals.mjs: SHA-256 2d16f83d221ea6bb28f1a05f48829c2e67e315d0acc2125fc8b642813a527f06 - scripts/prepare-investigation-brief.mjs: SHA-256 8a9c9a840e907985f8a84218251c33c38f3dc17956b851a8b5d7e28c56689edc - scripts/reconcile-candidates.mjs: SHA-256 ef8d6ae2f1e7e43c62a46dfe7af14e9618fd2b550724823448f8badf266cccaf - scripts/render-report.mjs: SHA-256 ab0a3f0188215fe0f9a464858b3a42c74e2d4daea6fe857b6a969595f27ebf5b - scripts/scan-codebase.mjs: SHA-256 4b5c847899604831aafd3fcdf860968792e99203670a3ba6f3947cb7ae708705 - scripts/verify-and-regen.mjs: SHA-256 9211268107c17f577d24a8994515946b9fd3a1fc1d2353a79dd0a139df25f706 - scripts/verify-finding.mjs: SHA-256 534590f7900e20648f67cc2d6845502960709ddfeb10cbb6733ade37b2eebe8e If a file does not match, it changed since the listing was prepared: do not install it yet, tell me what you found and let me decide. 2. Read SKILL.md in full, and tell me in plain words: what the skill does when used, what it connects to, whether it reads or sends any personal information or credentials, and anything that seems unusual. Stop on any red flag and tell me before going further. Confirm these points from the files: - The skill folder holds 156 files, including real executable code: SKILL.md (frontmatter name vercel-optimize), AGENTS.md, README.md, CONTRIBUTING.md and metadata.json at its root, 15 Node scripts under scripts/, 75 library files under lib/ (queries, gates, scanners, sanitizers) and 61 reference files under references/. Nothing in the folder is run during installation; everything is copied as-is. - Nothing is sent anywhere during installation itself; the only download at install time is the skill folder from GitHub at the pinned commit. No project of mine is linked, read or measured during installation. - At use time the scripts run locally against my linked Vercel project through my authenticated CLI session, collecting its metrics, usage and contract data and reading only candidate-bound source files; if the project or scope is ambiguous, the skill stops and asks me instead of guessing. Confirm the token rule from the SKILL.md: never type VERCEL_TOKEN=..., --token or an Authorization header into a shell command — authentication stays in the CLI session. - Do not run collect-signals or any other script, do not log in, do not link any project, and do not use the skill in any way during this install: using it is a separate step that only starts when I ask for an optimisation audit later. 3. When I say "yes, install", install it as a skill: copy the whole vercel-optimize folder into the agent's skills directory, in a folder named exactly "vercel-optimize", keeping its 156 files in their original relative layout (SKILL.md at its root). 4. Verify with no network calls: frontmatter valid (name: vercel-optimize), the 156 files in place with matching fingerprints. Do not run anything from the folder and do not use the skill to verify. 5. Report what was installed, where, and what I still need to do myself (for example: that using it needs a linked Vercel project, an authenticated CLI v53+, Node.js 20+ and Observability Plus, that it collects my project's metrics and usage on my own account, and that using it is a separate step that only starts when I ask for an audit). GitHub is optional: if I have a GitHub account or the gh CLI, you may use it; otherwise public access is fine. Never require it unless it's in the prerequisites above. Rules: don't touch anything outside the temp folder and the install target. If anything looks off, stop and ask me.