The user-prompt-submit-skill-inject hook injects MANDATORY skill-invocation directives based on single-keyword matches ("workflow", "verification", "chain", "deploy") with no project-relevance check.
In a local-only Python project (no vercel.json, no next.config.*, no Vercel dependencies — not a web app at all), it fired 8+ times in one working session. Each injection instructed the model it "must" run Vercel skills (Skill(workflow), Skill(verification), Skill(vercel-cli), Skill(bootstrap)), which contradicts the plugin's own session-context rule: "Use Vercel guidance only when the current repo, prompt, or tool call makes it relevant."
Example trigger from the session: the word "workflow" in a prompt about a local Python eval loop matched allOf [workflow, run] +4 and injected the full MANDATORY block with documentation links.
Suggested fix: gate injection on repository signals (presence of vercel.json / next.config.* / package.json with Vercel-ecosystem deps, or a linked Vercel project) before keyword scoring runs. The keyword matcher is a reasonable second stage, but as a first stage it produces a high false-positive rate in any agentic-tooling codebase, since words like "workflow" and "deploy" are generic.
Also observed: the plugin ended up installed twice via different marketplaces (vercel@claude-plugins-official 0.43.0 and vercel-plugin@vercel-vercel-plugin 0.32.0), doubling some injections. A dedupe warning at install time might be worth it.
Happy to provide the full trigger log from the session.
(Context: hit this while building a local agentic-coding stack — reachable at veeti.hietasalo@gmail.com if useful to discuss.)
The
user-prompt-submit-skill-injecthook injects MANDATORY skill-invocation directives based on single-keyword matches ("workflow", "verification", "chain", "deploy") with no project-relevance check.In a local-only Python project (no
vercel.json, nonext.config.*, no Vercel dependencies — not a web app at all), it fired 8+ times in one working session. Each injection instructed the model it "must" run Vercel skills (Skill(workflow),Skill(verification),Skill(vercel-cli),Skill(bootstrap)), which contradicts the plugin's own session-context rule: "Use Vercel guidance only when the current repo, prompt, or tool call makes it relevant."Example trigger from the session: the word "workflow" in a prompt about a local Python eval loop matched
allOf [workflow, run] +4and injected the full MANDATORY block with documentation links.Suggested fix: gate injection on repository signals (presence of
vercel.json/next.config.*/package.jsonwith Vercel-ecosystem deps, or a linked Vercel project) before keyword scoring runs. The keyword matcher is a reasonable second stage, but as a first stage it produces a high false-positive rate in any agentic-tooling codebase, since words like "workflow" and "deploy" are generic.Also observed: the plugin ended up installed twice via different marketplaces (
vercel@claude-plugins-official0.43.0 andvercel-plugin@vercel-vercel-plugin0.32.0), doubling some injections. A dedupe warning at install time might be worth it.Happy to provide the full trigger log from the session.
(Context: hit this while building a local agentic-coding stack — reachable at veeti.hietasalo@gmail.com if useful to discuss.)