Matt Pocock's Skills
mattpocock/skillsSmall, composable engineering skills: grill-me interviews, shared glossary, TDD, triage, prototyping, code review, handoff and a flow router.
Recommended
Check first Depth 2/5
Vercel Agent Skills Claude skills
Vercel's official 9-skill pack: React and Next.js performance rules, composition patterns, UI and writing review, React Native, deploy and cost audit.
Our verdict Recommended
First-party, actively updated and heavily installed; just know that two skills pull live instructions from GitHub and the deploy skills touch your Vercel account.
What Vercel Agent Skills does
This is Vercel's own collection of agent skills, split into rule libraries and procedures. The rule libraries are react-best-practices (70 rules in 8 priority bands, from eliminating request waterfalls and bundle size down to micro-optimizations), composition-patterns (avoiding boolean-prop sprawl with compound components, plus React 19 changes), react-native-skills (16 rules on lists, animation, images and platform patterns) and react-view-transitions. Two review skills, web-design-guidelines and writing-guidelines, do not carry rules themselves: they tell the agent to fetch the current rule file from another Vercel GitHub repo each time and then report findings as file:line.
The operational skills are deploy-to-vercel, which prefers git-push deploys and falls back to the CLI, vercel-cli-with-tokens, which finds a VERCEL_TOKEN in the environment or a .env file, and vercel-optimize. The last one is the deepest: about 17 KB of instructions, 64 reference files, 15 scripts and a lib folder of gates and scanners. It collects Vercel metrics and usage through the CLI first, then investigates only the routes those metrics point to and produces a ranked cost and performance report. Rule skills ship a compiled AGENTS.md (over 100 KB for React) alongside one file per rule.
Good for
- React and Next.js projects deployed on Vercel
- Reviewing components for waterfalls, bundle size and re-render problems
- Finding cost and caching problems in an existing Vercel bill
Not for
- Teams not on React or Vercel, where most rules do not apply
- Offline or air-gapped use of the two review skills, which fetch rules over the network
What's inside depth 3/5
9 skills averaging 7.7 KB; react-best-practices has 70 rule files and vercel-optimize adds 64 references, 15 scripts and a few tests, while two review skills are only about 1 KB each.
- Skills
- 9
- Reference docs
- 197
- Scripts
- 90
- Tests / evals
- 3
- Templates
- 0
- Avg SKILL.md
- 7.5 KB
Counted from the repository file tree. How we score depth.
Dependencies and costs
- Vercel CLI v53+ and a linked project for vercel-optimize
- Observability Plus for route-level metrics in vercel-optimize
- Node.js 20+ for vercel-optimize scripts
- A Vercel account or token for the deploy skills
- Telemetry: none found.
Security review
Broad accessThis skill asks for more access than most, or sends data to another service. That is usually a design choice rather than bad intent, but you should know before you install it.
- Loads instructions from a server at run timeTells the agent to WebFetch https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md on every run and apply the fetched rules and output format; unpinned main branch.skills/web-design-guidelines/SKILL.md:26
- Loads instructions from a server at run timeSame pattern: fetches https://raw.githubusercontent.com/vercel-labs/writing-guidelines/main/command.md at runtime and follows it as the review rules.skills/writing-guidelines/SKILL.md:26
A set of Vercel-authored skills: React/React Native/composition guidance (plain Markdown), deploy and token-based CLI guides, and a vercel-optimize audit pipeline of local Node scripts that call the Vercel CLI for read-only metrics. Two review skills (web-design-guidelines, writing-guidelines) fetch their rules from an unpinned GitHub main branch each run and follow them. The deploy skills install the Vercel CLI globally, can publish your project to a temporary public Vercel URL via npx vercel@latest, and say to ask before git push.
Worth knowing
- Runs remote code at an unpinned versionNo-auth fallback runs npx vercel@latest deploy --temporary -y, which builds locally and uploads the project to a temporary public Vercel deployment.skills/deploy-to-vercel/SKILL.md:167
- Installs packages or toolsInstructs npm install -g vercel when the CLI is missing (also in vercel-cli-with-tokens/SKILL.md:102).skills/deploy-to-vercel/SKILL.md:141
- Relies on a CLI or package we could not reviewdeploy-to-vercel, vercel-cli-with-tokens and vercel-optimize drive the Vercel CLI (v53+ for vercel-optimize), whose code is not in the repo; vercel-cli-with-tokens also mentions the stripe CLI for plan changes.skills/vercel-optimize/SKILL.md:16
- Needs an API key for its own serviceLooks for VERCEL_TOKEN in the environment or greps .env files for Vercel variables, exports it for the Vercel CLI only, and says never to pass it as --token.skills/vercel-cli-with-tokens/SKILL.md:20
- Makes network requestsvercel-optimize shells out (execFile) to the authenticated vercel CLI for metrics, usage, contract and read-only vercel api GET calls on teams and projects; deploy skills run vercel deploy/link/env/domains commands.skills/vercel-optimize/lib/vercel.mjs:80
- Contains compiled binariesThe repo inventory lists five skill zip archives (deploy-to-vercel, react-best-practices, react-view-transitions, vercel-cli-with-tokens, web-design-guidelines) that we could not read.skills/deploy-to-vercel.zip
What we checked
The repository (444 files) on Oct 29, 2026. Not a full review: 178 of 444 files were not downloaded (large repository; we reviewed the skill folders); it contains compiled binaries or archives we cannot read; we read 11 of 90 code files; it relies on code outside the repository: Vercel CLI (npm package vercel, installed globally by two skills) and the stripe CLI mentioned for plan changes; npx vercel@latest used by the temporary-deployment fallback; Content served at runtime from raw.githubusercontent.com/vercel-labs/web-interface-guidelines and vercel-labs/writing-guidelines (main branch).
NVIDIA SkillSpector static scan: 30 pattern hits (Privilege Escalation 10, MCP Rug Pull 9, Output Handling 2, YARA Match 2, Prompt Injection 2, Memory Poisoning 1). The HIGH hits are documentation: dangerouslySetInnerHTML and cookie/localStorage snippets in React rule examples, 'clear context' in a README, and 'access token', '.env' and printenv VERCEL_TOKEN in the vercel-cli-with-tokens guide, where the token is read for the Vercel CLI only. The info_stealer YARA hit is a comment about cookies/headers in force-dynamic.mjs. Unpinned 'npx' hits are install or example commands.
A review, not a certification. Skills change after we check them — read the files before installing.
License
MIT per the README and skill frontmatter; our copy of the repo had no separate LICENSE file, so check before redistributing.
Can it run unattended?
Not really. The rule skills are review checklists and vercel-optimize is a one-shot audit with a fresh run directory; none is designed as a long unattended loop.
Skills in this repository
| Skill | Installs |
|---|---|
| vercel-react-best-practices | 849K |
| web-design-guidelines | 797K |
| vercel-composition-patterns | 425K |
| vercel-react-native-skills | 259K |
| deploy-to-vercel | 174K |
| vercel-react-view-transitions | 172K |
| vercel-cli-with-tokens | 139K |
| vercel-optimize | 114K |
| writing-guidelines | 110K |
Linked skills have their own review.
Alternatives to Vercel Agent Skills
Web Quality Skills
addyosmani/web-quality-skillsSix skills by Addy Osmani for auditing and fixing web performance, Core Web Vitals, accessibility, SEO and best practices, built around Lighthouse.
Recommended
Check first Depth 3/5
Callstack Agent Skills
callstackincubator/agent-skillsReact Native skills from Callstack: performance, navigation, TV apps, upgrades, brownfield migration, GitHub Actions builds and device-driven testing.
Recommended
Check first Depth 4/5
Cloudflare Skills
cloudflare/skillsCloudflare's official 19-skill pack for building on Workers, Durable Objects, the Agents SDK, Cloudflare One and more, with an optional bundled MCP server.
Recommended
Check first Depth 4/5
FAQ
What is vercel-labs/agent-skills?
It is Vercel's official set of nine agent skills: React and Next.js performance rules, component composition patterns, React Native guidelines, view transitions, UI and writing reviews, and skills for deploying to and optimizing a Vercel project.
How do I install Vercel agent skills?
Run npx skills add vercel-labs/agent-skills and choose the skills you want, or install one with the skill name. The vercel-optimize skill also needs the Vercel CLI v53+ and a linked project.
Are the Vercel agent skills safe?
The scan hits are mostly documentation examples. The points to be aware of are that two review skills fetch rules from GitHub at run time, the token skill reads VERCEL_TOKEN, and the deploy skill can create a temporary public deployment.
Vercel agent skills vs Matt Pocock's skills?
Vercel's pack is framework specific: React, Next.js and Vercel platform rules. Matt Pocock's skills are general engineering habits such as TDD, triage and handoff. Many teams use both.
Sources: GitHub repository (stars, license, file tree, last push Oct 28, 2026); install counts from skills.sh via Best Skills (CC BY 4.0). Review based on the README and SKILL.md files as published.