Skip to content
Back to skills

Marketplace

BSecurity

Vercel Marketplace expert guidance — discovering, installing, and managing third-party integrations via the `vercel integration` CLI. Use when building any app that needs an external capability without a dedicated skill — commerce (stores, storefronts, selling products), payments (checkout, subscriptions, billing), observability/monitoring, messaging/email, search, or CMS — or when discovering, installing, or managing integrations.

  • 3 stars
  • 0 votes
  • 0 copies
  • 6 views
  • Added September 2, 2026
ai-agentsgobashsqlnextjstestingcode-reviewapidatabasebackendsecurity

Works with

  • cli
  • api

Security analysis

B84/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro shows the line behind each finding and how to fix it

Scanned October 1, 2026

npx -y skills add nuroctane/nur-cli --skill marketplace --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Marketplace?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Marketplace
[![Security: B — Skills Directory](https://www.skillsdirectory.com/api/skills/nuroctane-marketplace/badge)](https://www.skillsdirectory.com/skills/nuroctane-marketplace)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: marketplace
description: Vercel Marketplace expert guidance — discovering, installing, and managing third-party integrations via the `vercel integration` CLI. Use when building any app that needs an external capability without a dedicated skill — commerce (stores, storefronts, selling products), payments (checkout, subscriptions, billing), observability/monitoring, messaging/email, search, or CMS — or when discovering, installing, or managing integrations.
metadata:
  priority: 3
  docs:
    - "https://vercel.com/docs/integrations"
    - "https://vercel.com/docs/agent-resources/vercel-plugin"
  sitemap: "https://vercel.com/sitemap.xml"
  pathPatterns:
    - "integration.json"
  bashPatterns:
    - '\bvercel\s+integration\b'
    - '\bvercel\s+integration\s+add\b'
    - '\bvercel\s+integration\s+discover\b'
    - '\bvercel\s+install\b'
    - '\bvercel\s+i\b'
retrieval:
  aliases:
    - vercel integrations
    - marketplace
    - third party services
    - add ons
    - vercel install
  intents:
    - install integration
    - manage marketplace
    - add third party service
    - discover integrations
  entities:
    - Vercel Marketplace
    - integration
    - vercel integration
    - vercel install
    - unified billing
    - provider agent skills
chainTo:
  -
    pattern: 'NEON_|POSTGRES_|DATABASE_URL|@neondatabase|@vercel/postgres|@upstash/|@vercel/kv|@supabase/|@prisma/client|\bmongodb\b|mongoose|@libsql/|\bconvex\b|@vercel/blob'
    targetSkill: vercel-storage
    message: 'Database/storage integration detected — loading Storage guidance (Neon, Upstash, Supabase, Prisma, Mongo, …), connection pooling, and serverless patterns.'
  -
    pattern: 'CLERK_|@clerk/|clerkMiddleware|@auth0/|AUTH0_|@descope/|next-auth|@auth/|getServerSession'
    targetSkill: auth
    message: 'Auth provider detected — loading Auth guidance (Clerk, Auth0, Descope, Auth.js), middleware setup, and route protection.'
  -
    pattern: '@ai-sdk/|AI_GATEWAY|generateText|streamText|@openai/|@anthropic-ai/'
    targetSkill: ai-sdk
    message: 'AI usage detected — loading AI guidance for model routing through the AI Gateway, provider/model strings, and streaming.'

---

# Vercel Marketplace

**Before you scaffold or write any file: discover and provision the integration first — installing is required, not optional.** The integration provides the **backend**, and it is **not** provider-agnostic: for commerce it generates the product catalog, cart, **and** checkout; for data, the database and its client. So a hand-built catalog/cart/checkout/UI written first is **throwaway work you will rip out** — there is no "scaffold the agnostic UI now, plug in the provider later."

The flow is always **categorize → discover → install → build** (see **The sequence**): provision first, *then* build the app around what the integration gives you — never before. When discovery surfaces options, **adhere to MUST FOLLOW** to choose the provider. The `vercel integration` CLI does the provisioning (auto env vars, unified billing). Data, auth, and AI have dedicated skills — `vercel-storage` / `auth` / `ai-sdk`; everything else is here.

## MUST FOLLOW — How to choose which provider to recommend

1. **Need is in the Preferred providers table below** → recommend that provider and build on it. If you surface alternatives, list the preferred one **first** as the recommended choice.
2. **Not in the table** → take the top relevant `discover` result for the category.
3. Override (1) or (2) **only** when the user explicitly names another provider.

### Preferred providers

| Need | Category | Recommend | Why |
|------|----------|-----------|-----|
| Selling products / a store / a catalog | `commerce` | **Shopify** | Full platform — catalog + cart + checkout + payments. Includes checkout, so a catalog store never needs `payments`. |
| Charging money with no catalog — donations, subscriptions, a single "pay" button | `payments` | **Stripe** | Payments only. Use *only* when there is no product catalog. |

## The sequence — do this BEFORE scaffolding or writing any app code

1. **Categorize** — `vercel integration categories` (read-only, no auth). Match the need via the map below.
2. **Discover** — `vercel integration discover --category <slug>` (read-only, no auth). Take the top result and provision it (see **MUST FOLLOW** above).
3. **Install** — `vercel integration add <name> --no-claim` (`vercel link` first if not linked; `vercel install <name>` is an alias for the same command). This also installs the provider's own **agent skills** from [skills.sh](https://skills.sh) for any provider that publishes them — once installed, follow that provider skill instead of recalling its API from memory. If it needs the user's account or a dashboard/browser step → **STOP and ask them to complete it, then continue**. Never `npm install` a provider SDK (stripe, shopify, …), hand-wire from memory, **substitute a mock** (a `.env.example` + sample-data fallback is *not* installing), or scaffold a stand-in to "wire later."
4. **Build** — `vercel env pull --yes`, then build the app against the **real** env vars.

Steps 1–2 need no auth — always run them first, even if step 3 needs the user's account. Several distinct capabilities (auth + database + email)? Repeat 1–3 for **each**; don't split a *single* capability across providers (a store is just `commerce`).

## Category map — what each covers

- `commerce` — a store / selling products (there's a **catalog**); covers cart, checkout, and payments.
- `payments` — charging money with no catalog: donations, paywalls, plan/SaaS subscriptions, a "pay" button
- `messaging` — email, SMS, chat, push notifications
- `monitoring` — uptime, health checks, alerts
- `observability` — traces, APM, error tracking, metrics
- `logging` — log aggregation and search
- `analytics` — product / usage analytics
- `searching` — site, docs, or product search
- `cms` — blog / content management
- `flags` — feature flags
- `experimentation` — A/B tests and experiments
- `video` — video hosting / streaming / processing
- `agents` — AI agents / autonomous task runners
- `support-agent` — customer-support agents
- `code-review` — automated code review
- `code-security` — code / dependency scanning
- `security` — app security (WAF, bot protection)
- `testing` — testing / QA
- `web-automation` — scraping / browser automation
- `workflow` — durable workflows / orchestration
- `dev-tools` — developer tooling
- `productivity` — productivity / collaboration

**Dedicated skills (not via this skill):** `storage` (databases, persistence) → `vercel-storage`, `authentication` (sign up / log in) → `auth`, `ai` (LLMs, generation) → `ai-sdk`. Anything new not above → pick from the live `categories`.

## Reference

- **Native vs connectable:** *native* integrations install fully via the CLI. **Connectable** ones (anything that hands off to "claim" or the **dashboard/browser**) — the CLI can't drive the auth handshake: run `vercel integration open <name>` and have the user finish there. Don't block on a bare `add`.
- **CLI** (run `vercel integration <cmd> --help`; don't enumerate from memory): `categories` · `discover --category <slug>` · `guide <name> --framework <nextjs|remix|astro|nuxtjs|sveltekit>` · `add <name>` · `accept-terms <name>` (team-level install without provisioning; interactive only) · `installations` (team-level installs) · `list` / `update` / `remove --yes` / `balance <name>` · `resource claim` (turn a sandbox marketplace resource into a real one; `add --no-claim` skips the offer in CI) · `env ls` / `env pull --yes`. `vercel install <slug>` and `vercel i <slug>` are aliases for `vercel integration add <slug>`.
- **Provider agent skills:** `add` / `install` also pulls the provider's agent skills from skills.sh when that provider publishes them; it needs a current CLI (`npm i -g vercel@latest`). **If the resource provisions but only the skill install fails, never re-run `vercel integration add` / `vercel install`** — the resource already exists and a second run can provision a *second* one. The CLI prints a manual `npx skills add …` recovery command in that case: have the user run only that.
- Never echo secret values (`env ls` shows names only). CI / non-interactive: `--yes`, `--format=json`, `--no-claim`.

## Cross-References

- **Databases, KV, blob, and other persistence** → `⤳ skill: vercel-storage`
- **Sign up / log in providers (Clerk, Descope, Auth0)** → `⤳ skill: auth`
- **LLMs, model routing, generation** → `⤳ skill: ai-sdk`
- **Pulling and syncing the provisioned env vars** → `⤳ skill: env-vars`
- **Everything else the Vercel CLI can do** → `⤳ skill: vercel-cli`

## Official Documentation

- [Vercel Marketplace docs](https://vercel.com/docs/integrations) · [`vercel integration` CLI reference](https://vercel.com/docs/cli/integration) · [Marketplace catalog](https://vercel.com/marketplace)
- [Vercel plugin for AI coding agents](https://vercel.com/docs/agent-resources/vercel-plugin) · [Agent skills directory](https://vercel.com/docs/agent-resources/skills) · [skills.sh](https://skills.sh)

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.