deploy-to-vercel: no-auth fallback uploads the whole folder, ignores .gitignore, and runs without asking

I reviewed the deploy-to-vercel skill (version 3.0.0, commit 063bee9) before installing it. It pre-approves nothing and deploys as a preview unless asked, which is good. One behaviour could expose files the user never meant to publish.

1. It falls back without asking. SKILL.md:296 tells the agent to fall back to the no-auth script when vercel login or vercel deploy fails with an authentication error. The Codex section (SKILL.md:205) does the same when the CLI is missing. The user isn't asked first.

2. It uploads almost everything. resources/deploy.sh:201-206 and resources/deploy-codex.sh pack the whole folder and leave out only node_modules, .git, .env and .env.*. They ignore .gitignore and .vercelignore. Files like secrets.json, .npmrc, credential files, local databases or data exports would be uploaded.

3. The result is a live site. The upload goes to claude-skills-deploy.vercel.com (or codex-deploy-skills.vercel.sh), and the skill returns a live preview URL (SKILL.md:164). Until the user claims it, the deployment sits in an account the user doesn't control. The claim URL can also be lost: the script runs with set -euo pipefail (deploy.sh:7), so a network error while it polls the preview URL ends the script before it prints the claim URL, which it does only at the end. The preview URL is already printed by then, so the user is left with a live copy of their files that they can't claim or delete.

4. The user can't see any of this. In Claude Code the permission prompt shows only bash .../deploy.sh, not what will be uploaded or that the result will be live.

Suggestions

• Ask the user before the fallback, and say what will be uploaded and that the preview will be live.
• Respect .gitignore and .vercelignore, for example with git ls-files when the folder is a git repo.
• List the files, or at least their count, before uploading.
• Print the claim URL as soon as the upload returns, before polling.

Smaller points: SKILL.md:67 runs git add . before a push, which can stage untracked secrets (it does ask before this step). On main that push is a production deploy, though line 11 says to always deploy as a preview. Archive.zip holds an older copy of the skill (open PR #176 removes it).