vercel-env-puller

What problem does it solve?

This Skill prevents autonomous sandboxes from over-seeing or leaking production secrets by pulling and injecting only the named Vercel environment variables required for a specific project run.

Core Features & Use Cases

• Per-project env manifests (names + targets only): Uses a manifest design that stores variable names and criticality (no secret values at rest).
• Least-privilege runtime injection: Resolves actual values on-demand via vercel env pull, injects them in-memory into the Sandcastle agent, and unlinks any temporary pull/config artifacts in finally.
• Hardwired secret and log safety rules: Ensures stdout/audit never includes secret values, and applies skip-pattern enforcement (e.g., NEXT_PUBLIC_*, operator-only secrets, analytics, Vercel build envs).
• Auth-failure detection and escalation: Detects authentication/permission failures after runs, triggers CFO alerts, and can lock further runs until manifest review.
• Cross-project isolation guarantees: Ensures each Sandcastle execution loads exactly one project’s manifest and only injects that project’s resolved env dictionary.

Quick Start

Ask the agent to resolve environment variables for a given project run by calling the runtime path that pulls Vercel env values for the specified project_slug and returns only the filtered in-memory env_dict.