CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

vercel-sandbox

Run untrusted or AI-generated code in ephemeral Firecracker microVMs with @vercel/sandbox. Create a VM, run commands, read/write files, expose ports, snapshot and resume. Use for AI agents, code execution, builds, and isolated experimentation.

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

The canonical home for this skill is vercel-sandbox in vercel/vercel-plugin

SKILL.md
Quality
Evals
Security

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, information-dense skill with excellent executable examples and explicit validation guidance throughout. Its main weakness is structure: everything is packed into a single monolithic SKILL.md with no reference files, and the closing checklist duplicates earlier sections.

Suggestions

Move secondary topics (Drives, Multi-agent isolation, Images/custom VCR builds, and the detailed lifecycle/hook semantics) into references/ files, keeping SKILL.md as a lean overview with one-level-deep, clearly signaled links.

Trim the Best-practice checklist to points not already covered inline, or cut the duplicated in-section caveats instead, to remove the redundancy between the body and the summary.

Consolidate the repeated hook behavior caveats in the lifecycle section — the onCreate/onResume exclusivity and different-process-resume warnings each appear twice.

DimensionReasoningScore

Conciseness

The body is dense with non-obvious API facts ('there is no shell', non-zero exit codes do not throw, 'package lists ship empty', bind 0.0.0.0) and explains nothing Claude already knows, but the Best-practice checklist largely restates earlier sections and hook semantics repeat their caveats — minor trimming opportunities that keep it below the lean anchor.

4 / 5

Actionability

Every section ships copy-paste-ready executable code: the minimal create/run/stop loop, bash -c wrapping, apt install with exit-code check, a poll-until-ready loop for exposed ports, snapshot create/resume, network-policy credential brokering, and CLI commands — covering the common cases end to end.

5 / 5

Workflow Clarity

Sections progress logically from install to advanced topics with explicit validation checkpoints (exit-code checks, guarding the null readFileToBuffer result, polling for port readiness), an error-recovery pattern (throw with awaited stderr), and a final best-practice checklist.

5 / 5

Progressive Disclosure

There are no bundle files at all: roughly 330 lines live entirely inline in SKILL.md with no one-level-deep references, and content that plausibly belongs in separate files (drives, multi-agent isolation, network-policy details, lifecycle/hook semantics) is inlined — even though the sections themselves are well-organized with clear headers and internal anchors.

3 / 5

Total

17

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: concrete third-person actions, an explicit 'Use for' trigger clause, and a clearly delineated niche. The only gap is modest synonym coverage in trigger terms.

Suggestions

Add one or two common trigger synonyms such as 'code execution' or 'sandboxing untrusted code' to broaden natural keyword coverage.

DimensionReasoningScore

Specificity

The description lists five concrete, third-person actions — 'Create a VM, run commands, read/write files, expose ports, snapshot and resume' — matching the comprehensive-coverage anchor, with no vague filler.

5 / 5

Completeness

It explicitly answers both 'what' (create a VM, run commands, read/write files, expose ports, snapshot and resume) and 'when' via the concrete trigger clause 'Use for AI agents, code generation, builds, and isolated experimentation'.

5 / 5

Trigger Term Quality

Natural phrases like 'untrusted or AI-generated code', 'AI agents', and 'isolated experimentation' give good keyword coverage, but common variations users might say (e.g. 'code execution', 'sandboxing', 'isolation') are missing, so it fits the 'good coverage, a few natural terms missing' anchor rather than the comprehensive one.

4 / 5

Distinctiveness Conflict Risk

'Ephemeral Firecracker microVMs with @vercel/sandbox' carves out a clear niche, and the triggers are specific enough that the description is unlikely to fire for unrelated skills.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

vercel/vercel-plugin

Path

skills/vercel-sandbox/upstream/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.