[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7CG47ACN8CK4VCDSDXJYCYA":3,"skill-same:01M7CG47ACN8CK4VCDSDXJYCYA":47},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":24,"commitSha":25,"skillDirectory":26,"forksCount":27,"repositoryHtmlUrl":28,"repositoryHomepageUrl":29,"ownerHtmlUrl":30,"ownerBlogUrl":29,"ownerDescription":31,"updatedAt":32,"install":33,"resources":46},"01M7CG47ACN8CK4VCDSDXJYCYA","vercel-env-vars",null,"Manage Vercel environment variables safely. Environments, vercel env ls\u002Fadd\u002Fupdate\u002Frm\u002Fpull\u002Frun, sensitive variables, NEXT_PUBLIC exposure, when changes take effect. Use when adding, rotating, auditing or pulling Vercel env vars.","codewhale-hq\u002Fcodewhale-plugin-marketplace","codewhale-hq","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F326694313?v=4","01M6CDD9D70AD3631SMRJ7REW4","Codewhale","01M7CFYTPJMP417FBR6K9VE5VN",5,"MIT","https:\u002F\u002Fgithub.com\u002Fcodewhale-hq\u002Fcodewhale-plugin-marketplace\u002Fblob\u002Fmain\u002Fplugins\u002Fvercel-workflow\u002Fskills\u002Fvercel-env-vars\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: vercel-env-vars\ndescription: Manage Vercel environment variables safely. Environments, vercel env ls\u002Fadd\u002Fupdate\u002Frm\u002Fpull\u002Frun, sensitive variables, NEXT_PUBLIC exposure, when changes take effect. Use when adding, rotating, auditing or pulling Vercel env vars.\n---\n\n# Vercel environment variables\n\nSecrets are the highest-risk thing this skill touches. Rules first:\n\n1. Never print, log, echo or paste a variable's value into the chat, a commit, a\n   command line or a file in the repository. Refer to variables by name.\n2. Never ask the user to paste a secret into the chat. Tell them to run the\n   command that prompts for the value in their own terminal.\n3. Any write (`add`, `update`, `rm`, `--force`) changes the user's project and\n   needs a yes from the user in this conversation for that specific variable,\n   environment and project. Reads of names (`vercel env ls`) do not.\n\n## Environments\n\n| Environment | Used by | Notes |\n| --- | --- | --- |\n| Production | production deployments (an approved production deploy, or a push to the production branch) | |\n| Preview | every non-production deployment; can be limited to one Git branch | a branch-specific value overrides the general Preview one |\n| Development | `vercel dev`, `vercel env pull` | not used by deployments |\n| Custom (for example `staging`) | deployments targeting that environment | can import from another environment |\n\n- Changes apply only to **new** deployments. An existing deployment keeps the\n  values it was built with; redeploy to pick up a change.\n- Total size is 64 KB per deployment; Edge Runtime code is limited to 5 KB per\n  variable.\n- The CLI stores production, preview and custom variables as\n  **sensitive** by default (value cannot be read back from the dashboard or\n  CLI). Development variables stay encrypted. `--no-sensitive` opts out, which\n  a team policy may forbid; do not use it without approval.\n- Variables reach code as `process.env.NAME`. Vercel also sets system variables\n  such as `VERCEL_ENV` (`production`, `preview`, `development`), `VERCEL_URL`\n  (no protocol), `VERCEL_PROJECT_PRODUCTION_URL`, and `VERCEL_GIT_COMMIT_REF`.\n\n## Public prefixes expose values to browsers\n\nFrameworks inline variables with a public prefix (`NEXT_PUBLIC_`, `VITE_`,\n`PUBLIC_`, `NUXT_PUBLIC_`, `REACT_APP_`, `EXPO_PUBLIC_`) into client bundles at\n**build time**. Rules:\n\n- Never put a secret, private key, service-role key or password under a public\n  prefix. A publishable or anon key is fine by design.\n- Changing a public variable requires a rebuild, not just a restart.\n- `\u002Fvercel-preflight` flags public-prefixed names that look secret.\n\n## Commands\n\n```bash\nvercel env ls                        # names, environments, types (no values for sensitive ones)\nvercel env ls preview feature-x      # one environment, one branch\nvercel env pull .env.local           # writes DEVELOPMENT values to a file (secrets on disk)\nvercel env pull .env.preview.local --environment=preview --git-branch=feature-x\nvercel env run -- next dev           # run a command with Development values, nothing written\nvercel env run -e preview -- npm test\nvercel env add API_TOKEN production  # prompts for the value in the user's terminal\nvercel env update API_TOKEN production\nvercel env rm OLD_TOKEN production\n```\n\n- Prefer `vercel env run -- \u003Ccmd>` over `pull` when the values are only needed for\n  one command: nothing is written to disk.\n- `vercel env pull` merges into an existing file and keeps local-only entries.\n  Before pulling, confirm the target file is covered by `.gitignore`\n  (`.env*.local` is the usual pattern). Sensitive values that Vercel cannot\n  return are written as placeholders.\n- Never put a secret in a pipe or argument (`echo $SECRET | vercel env add ...`):\n  it lands in shell history. Let the CLI prompt, or redirect from a file the user\n  controls (`vercel env add NAME production \u003C secret.txt`), and tell the user to\n  delete that file afterward.\n- Rotating a secret: add the new value with the provider first, `vercel env\n  update`, redeploy, verify, then revoke the old one. Each step is a separate\n  approval-worthy action.\n- `vercel env rm` on a variable still in use breaks the next deployment; check\n  usage in code first (`grep -rn \"process.env.NAME\"`).\n\n## Auditing\n\nTo audit without reading values: `vercel env ls`, then compare names against what\nthe code reads (`grep -rhoE \"process\\.env\\.[A-Z0-9_]+\" --include=*.{ts,tsx,js,jsx,mjs}`)\nand against `.env.example`. Report variables that are used but not defined for an\nenvironment, defined but unused, and secret-looking names with a public prefix.\n\n## Done means\n\nNames were checked or changed as approved, no value appeared in output or files,\nand the user knows which deployments still need a redeploy to see the change.\n","# Vercel environment variables\n\nSecrets are the highest-risk thing this skill touches. Rules first:\n\n1. Never print, log, echo or paste a variable's value into the chat, a commit, a\n   command line or a file in the repository. Refer to variables by name.\n2. Never ask the user to paste a secret into the chat. Tell them to run the\n   command that prompts for the value in their own terminal.\n3. Any write (`add`, `update`, `rm`, `--force`) changes the user's project and\n   needs a yes from the user in this conversation for that specific variable,\n   environment and project. Reads of names (`vercel env ls`) do not.\n\n## Environments\n\n| Environment | Used by | Notes |\n| --- | --- | --- |\n| Production | production deployments (an approved production deploy, or a push to the production branch) | |\n| Preview | every non-production deployment; can be limited to one Git branch | a branch-specific value overrides the general Preview one |\n| Development | `vercel dev`, `vercel env pull` | not used by deployments |\n| Custom (for example `staging`) | deployments targeting that environment | can import from another environment |\n\n- Changes apply only to **new** deployments. An existing deployment keeps the\n  values it was built with; redeploy to pick up a change.\n- Total size is 64 KB per deployment; Edge Runtime code is limited to 5 KB per\n  variable.\n- The CLI stores production, preview and custom variables as\n  **sensitive** by default (value cannot be read back from the dashboard or\n  CLI). Development variables stay encrypted. `--no-sensitive` opts out, which\n  a team policy may forbid; do not use it without approval.\n- Variables reach code as `process.env.NAME`. Vercel also sets system variables\n  such as `VERCEL_ENV` (`production`, `preview`, `development`), `VERCEL_URL`\n  (no protocol), `VERCEL_PROJECT_PRODUCTION_URL`, and `VERCEL_GIT_COMMIT_REF`.\n\n## Public prefixes expose values to browsers\n\nFrameworks inline variables with a public prefix (`NEXT_PUBLIC_`, `VITE_`,\n`PUBLIC_`, `NUXT_PUBLIC_`, `REACT_APP_`, `EXPO_PUBLIC_`) into client bundles at\n**build time**. Rules:\n\n- Never put a secret, private key, service-role key or password under a public\n  prefix. A publishable or anon key is fine by design.\n- Changing a public variable requires a rebuild, not just a restart.\n- `\u002Fvercel-preflight` flags public-prefixed names that look secret.\n\n## Commands\n\n```bash\nvercel env ls                        # names, environments, types (no values for sensitive ones)\nvercel env ls preview feature-x      # one environment, one branch\nvercel env pull .env.local           # writes DEVELOPMENT values to a file (secrets on disk)\nvercel env pull .env.preview.local --environment=preview --git-branch=feature-x\nvercel env run -- next dev           # run a command with Development values, nothing written\nvercel env run -e preview -- npm test\nvercel env add API_TOKEN production  # prompts for the value in the user's terminal\nvercel env update API_TOKEN production\nvercel env rm OLD_TOKEN production\n```\n\n- Prefer `vercel env run -- \u003Ccmd>` over `pull` when the values are only needed for\n  one command: nothing is written to disk.\n- `vercel env pull` merges into an existing file and keeps local-only entries.\n  Before pulling, confirm the target file is covered by `.gitignore`\n  (`.env*.local` is the usual pattern). Sensitive values that Vercel cannot\n  return are written as placeholders.\n- Never put a secret in a pipe or argument (`echo $SECRET | vercel env add ...`):\n  it lands in shell history. Let the CLI prompt, or redirect from a file the user\n  controls (`vercel env add NAME production \u003C secret.txt`), and tell the user to\n  delete that file afterward.\n- Rotating a secret: add the new value with the provider first, `vercel env\n  update`, redeploy, verify, then revoke the old one. Each step is a separate\n  approval-worthy action.\n- `vercel env rm` on a variable still in use breaks the next deployment; check\n  usage in code first (`grep -rn \"process.env.NAME\"`).\n\n## Auditing\n\nTo audit without reading values: `vercel env ls`, then compare names against what\nthe code reads (`grep -rhoE \"process\\.env\\.[A-Z0-9_]+\" --include=*.{ts,tsx,js,jsx,mjs}`)\nand against `.env.example`. Report variables that are used but not defined for an\nenvironment, defined but unused, and secret-looking names with a public prefix.\n\n## Done means\n\nNames were checked or changed as approved, no value appeared in output or files,\nand the user knows which deployments still need a redeploy to see the change.\n",{"name":5,"description":7},"main","e83cac15fc63134280e964895df4d584e5702c13","plugins\u002Fvercel-workflow\u002Fskills\u002Fvercel-env-vars",2,"https:\u002F\u002Fgithub.com\u002Fcodewhale-hq\u002Fcodewhale-plugin-marketplace","https:\u002F\u002Fcodewhale.net","https:\u002F\u002Fgithub.com\u002Fcodewhale-hq","Open-source coding agent for your terminal. Works with the model provider you choose.","2026-11-13 11:48:42",{"source":8,"skillName":5,"commands":34,"prompt":44,"zipAvailable":45},[35,38,41],{"tool":36,"command":37},"npx","npx skills add codewhale-hq\u002Fcodewhale-plugin-marketplace --skill vercel-env-vars",{"tool":39,"command":40},"bunx","bunx skills add codewhale-hq\u002Fcodewhale-plugin-marketplace --skill vercel-env-vars",{"tool":42,"command":43},"pnpm","pnpm dlx skills add codewhale-hq\u002Fcodewhale-plugin-marketplace --skill vercel-env-vars","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fcodewhale-hq\u002Fcodewhale-plugin-marketplace\u002Fblob\u002Fmain\u002Fplugins\u002Fvercel-workflow\u002Fskills\u002Fvercel-env-vars\u002FSKILL.md",true,[],[48,55,62,69,75,82],{"skillNo":49,"name":50,"nameZh":6,"description":51,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":52,"categories":53,"keywords":54,"publishedAt":19},"01M7CG92AM4VSATJQ927PE34G4","xlsx","Create\u002Fedit\u002Fanalyze\u002Fverify spreadsheet workbooks including XLSX\u002FCSV\u002FTSV.","https:\u002F\u002Fgithub.com\u002Fcodewhale-hq\u002Fcodewhale-plugin-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fxlsx\u002FSKILL.md",[],[],{"skillNo":56,"name":57,"nameZh":6,"description":58,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":59,"categories":60,"keywords":61,"publishedAt":19},"01M7CG8ZBZXPCJACH06SFV39NM","webapp-testing","Start\u002Freuse a local app, wait for readiness, inspect rendered state\u002Fconsole\u002Fnetwork, act from observed selectors, and verify with evidence.","https:\u002F\u002Fgithub.com\u002Fcodewhale-hq\u002Fcodewhale-plugin-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwebapp-testing\u002FSKILL.md",[],[],{"skillNo":63,"name":64,"nameZh":6,"description":65,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":66,"categories":67,"keywords":68,"publishedAt":19},"01M7CG8XF83CD62S7TCPMECV4N","verify","Exercise the real app\u002FAPI\u002FCLI and collect observable evidence; tests alone do not count as end-to-end verification.","https:\u002F\u002Fgithub.com\u002Fcodewhale-hq\u002Fcodewhale-plugin-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fverify\u002FSKILL.md",[],[],{"skillNo":70,"name":71,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":72,"categories":73,"keywords":74,"publishedAt":19},"01M7CG8VF7HN4EHQM3PP877PB6","tts","https:\u002F\u002Fgithub.com\u002Fcodewhale-hq\u002Fcodewhale-plugin-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Ftts\u002FSKILL.md",[],[],{"skillNo":76,"name":77,"nameZh":6,"description":78,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":79,"categories":80,"keywords":81,"publishedAt":19},"01M7CG8RSMADT0QKP2ZSF6EN6T","test","Detect the project’s test stack, run the narrowest useful tests, create tests when authorized, and report coverage\u002Fgaps honestly.","https:\u002F\u002Fgithub.com\u002Fcodewhale-hq\u002Fcodewhale-plugin-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Ftest\u002FSKILL.md",[],[],{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":88,"publishedAt":19},"01M7CG8MQTZ8VT7E4V3VY78F8X","spreadsheets","Compatibility alias for the xlsx skill. Prefer loading xlsx.","https:\u002F\u002Fgithub.com\u002Fcodewhale-hq\u002Fcodewhale-plugin-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fspreadsheets\u002FSKILL.md",[],[]]