CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

vercel-sandbox

Vercel Sandbox guidance — ephemeral Firecracker microVMs for running untrusted code safely. Supports AI agents, code generation, and experimentation. Use when executing user-generated or AI-generated code in isolation.

63

Quality

79%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./plugins/vercel/skills/vercel-sandbox/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Excellent actionability — every example is runnable as written and the core withBrowser pattern handles credentials, snapshot branching, and cleanup correctly. The main costs are the verbatim duplication of the Chromium dependency list and install steps, and the absence of any validation or error-recovery checkpoints around command output parsing.

Suggestions

Define CHROMIUM_SYSTEM_DEPS and the install sequence once (e.g. a small scripts/install-chromium.sh or a shared code block) and reference it from both the Core Pattern and the snapshot-creation sections.

Add a brief error-handling note for JSON.parse of agent-browser --json output (check the exit code / stderr before parsing) to close the workflow-validation gap.

Clarify in the fillAndSubmitForm example how element refs are obtained from the a11y snapshot, since "// Parse snapshot to find element refs..." is the one non-executable placeholder.

DimensionReasoningScore

Conciseness

Code-heavy and lean with almost no concept padding — the Docker-image analogy is one sentence and earns its place. The 24-package CHROMIUM_SYSTEM_DEPS list and the dnf/npm install sequence are duplicated verbatim between "Core Pattern" and "Creating a sandbox snapshot", which is pure token cost.

4 / 5

Actionability

Fully executable, copy-paste-ready TypeScript throughout: withBrowser with credential resolution and snapshot branching, screenshot/a11y-snapshot/form-fill/cron examples, snapshot creation, an env-var table, and a framework table covering the common cases. No key details are missing — even cleanup (finally { sandbox.stop() }) and base64 readback are shown.

5 / 5

Workflow Clarity

Sequences are explicit and ordered (create → install deps → run → guaranteed stop via finally) with fail-fast && chaining in the install command. Missing explicit validation: JSON.parse of command stdout has no error handling, and there is no verification that the Chromium install succeeded or recovery guidance when a runCommand fails mid-workflow.

4 / 5

Progressive Disclosure

A self-contained skill (no bundle files exist) with clear section headers, an env-var table, and one clearly signaled external pointer (examples/environments/ in the agent-browser repo). At ~275 lines with a duplicated dependency list, the snapshot-creation section is a candidate for a separate file, keeping it below the clear-overview-with-split-content anchor.

4 / 5

Total

17

/

20

Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A solid description with an explicit use-when clause and a well-defined niche, held back by capability vagueness — it says what the technology is but not what the skill concretely does. Notably, the description promises general sandbox guidance while the body is exclusively about browser automation with agent-browser, so the description neither reflects nor triggers for the body's actual content.

Suggestions

State the skill's concrete capabilities as actions, e.g. "Run agent-browser + headless Chrome inside ephemeral Vercel Sandbox microVMs to take screenshots, capture accessibility snapshots, and automate page interactions."

Align the trigger terms with the body's actual use cases — add browser-automation phrases (headless Chrome, screenshot a page, browser automation) or narrow the description to match the sandbox-guidance framing.

Mention the SDK package name (@vercel/sandbox) in the description so users naming the package trigger the skill naturally.

DimensionReasoningScore

Specificity

Names the domain and mechanism concretely ("ephemeral Firecracker microVMs for running untrusted code safely") but never enumerates specific actions — "Supports AI agents, code generation, and experimentation" is scope-listing rather than concrete capabilities.

3 / 5

Completeness

Both parts are explicit: the what ("ephemeral Firecracker microVMs for running untrusted code safely") and the when ("Use when executing user-generated or AI-generated code in isolation"). Not a 5 because the what is framed as "guidance" and the mechanism rather than the skill's concrete capabilities.

4 / 5

Trigger Term Quality

Good natural-term coverage ("untrusted code", "AI-generated code", "in isolation", "sandbox", "execute") but misses common variations a user would say such as "playground", "code runner", or "isolated environment" as a phrase.

4 / 5

Distinctiveness Conflict Risk

"Vercel Sandbox" plus "Firecracker microVMs" carves a clear niche, but "sandbox" is a broadly used term with genuine overlap risk against generic sandboxing or code-execution skills; the Vercel branding keeps it mostly distinct.

4 / 5

Total

15

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

metadata_field

'metadata' should map string keys to string values

Warning

Total

14

/

16

Passed

Repository

openai/plugins

Path

plugins/vercel/skills/vercel-sandbox/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.