Vercel Skills Night SF 2.17.26

Thank you, G. Who here has installed a skill in the past, I would say, three weeks? Nice. Who here has installed React Best Practices by Vercel in the past 3 weeks? Did you all know that React Best Practices is the whole origin of why this whole thing exists? We have this really cracked web engineer at Vercel named Shu. You may have seen his content somewhere. You may have seen him post about some React hacks or some web tricks. He decided one weekend to just write down all he knows about React and the web and publish it in this like web bible. And we were trying to figure out how we can get this into the world. How do we make every coding model, every single person better at React to be as good as Shu? And we initially thought maybe a blog post, maybe docs, but then sure, maybe Claude Sonnet 9 will know it and maybe Gemini 7 would know it. And we also thought about putting it into an MCP server, but it felt a little heavy for just markdown documentation. And so then we came to skills. And as I was helping him write the docs for how to use React best practices, I end up having to copy and paste instructions from Claude Code, Cursor, all these different coding agents into very small different sort of instructions. And I was like, this is terrible. Let me just make a CLI that can install it all into one place. And that became npx skills. And then we started adding anonymous telemetry to every time you install a skill to discover new skills. And that exactly what powers our skills leaderboard skills.sh. And so today, skills is very strong. We have so far 2 million plus installs using just our CLI, let alone everyone else's different methods of installing and copying skills. And we are tracking over 60,000 unique skills on Skills.sh. And that's why today we actually announced that we are partnering with three security companies, Gen, Socket, and Snyk to do security audits on all 62,000 skills because we want people to be able to use skills securely and also know what they're about to get into. And so here's a preview of the audits page and I'll bring them up shortly to sort of give their spiel about what they're doing and how skills matters. But we are running audits on all 62,000 skills and every new skill that comes on and we're giving you an assessment and we're trying to give recommendations based on different providers and different partners in the industry. Thank you. And now maybe a few words from some of our security partners starting with Gen Digital. Here's Shu from Gen Digital Agent Trust Hub.

Hey everyone. Am I going on stage? Hi everyone, my name is Shu. I work at Gen Digital. We are building the agent trust layer. So we were really excited to partner with Andrew and Skills.sh because as soon as Skills dropped, there were so many skills and many of them were kind of sus and we saw a lot of developers walk the fine line of like do I let my agents go loose and figure out how to solve these problems or do I watch and monitor everything? And so we're really excited to partner here. Generally, our vision, our mission is to bring peace of mind to everyone. And so we really want you to unlock the power of your agents and give you the trust layer. We actually just launched a product or will be launching tomorrow called Sage, which will monitor every connection that comes in and out of any agents you have. So you can install it for Cursor, Claude Code, and basically tell your agents, go nuts. Figure out how to solve this problem and you don't have to worry about your data being taken, any prompt injection risks and things like that. And then the last thing I want to say is that, you know, we're really excited to work with any developers, anybody that's building on this agent layer. So check us out at ai.jendigital.com. We have a booth in the back. Come find us. We can show you some cool stuff. Thank you.

Thank you, Shu. And now from Socket, we have Ryan.

Thanks so much, Andrew. Hey y'all. I'm Ryan. I'm an engineering lead at Socket. And what Socket does is we scan open source software for malware. We've traditionally focused on like npm and PyPI and Maven and whatnot. But we have started scanning like browser extensions and VS Code extensions as well. And now skills. And these I think these fit really well together. I think compared to what other people are doing for skills scanning, Socket is a little bit different because we do cross ecosystem scanning of all of the files that are included in skills. So for example there was one skill that we were looking at last week where if you just look at the markdown file there's nothing suspicious in it. Like everything looks completely fine, but the skills directory included some Python code which opened a backdoor and like opened a remote shell for an attacker to run arbitrary code on your machine which is obviously really bad. And we were able to find that because we look at all of the skills, all of the source files in the skills directory and run our cross ecosystem scanners on all of those. And then we also use a combination of static and AI analysis to look at the skills. So we will do like a static analysis first pass to look for suspicious signals and then we reduce noise using an LLM and that allows us to get better determinism, more consistent results, more reliable results and also better resilience to prompt injection. So we benchmarked ourselves on like 800 skills over the last week and just like some numbers, we saw like 95% precision, 98% recall and 97% F1. So we're still improving this. I think we got a long way to go. But the initial results have been really promising and we are excited to work together on making skills safe to use. They're really awesome and we want to make it so that you don't have to worry about them. So, thanks so much y'all.

Thank you, Ryan. Now, we're going to have some cool demos from some of our partners as well as some maybe demonstrations of skills, maybe some things they've built. Starting with David Kramer from Sentry.

This is interesting. Hey everybody. If you don't know me, I started Sentry a long time ago, the error monitoring company and other things. We have this product called Seer, which does code review is probably the easiest way to think about it, but it's about error prediction. And so I thought it would be a good idea to recreate something like Seer and give it away for free. But mostly what I was interested in was like what if you could run skills on pull requests? What if you could treat prompts or agents as linters? Assuming you have unlimited budget mind you. And so I built something which again it's technically a competitor to us I guess, a competitor to Vercel Agent too, but called Warden. It's warden.dev. It's on GitHub. And let's see, we got we'll call it four minutes remaining. I'm going to go through this real quick, but what I thought would be fun is because everybody likes to pick on Neon. I thought we would keep that going. And so I have the Neon skills repo locally. And let's see if I got everything in my history here. I just want to show you what this does because it's pretty straightforward. So we run warden init. It creates a config file. It creates a GitHub workflow and then it actually uses your Claude credentials and so we're actually going to be able to run it. And I also have this little skill scanner, coincidence, purely coincidence. That we wrote internally to demo this that we run on pull request to our internal skill repo if that makes any sense. Don't worry about it too much. Just know I have this scanner thing. And then I'm going to run this and then I'm going to talk about what's going on. We want this one. And so what this does is it's a harness that can wrap any skill file. For example, it works great with the React best practices from Vercel. Here's a demo of what that looked like. We'll let the Neon thing run in the background. I actually took a starter Next.js app, ran this against it, and I don't know if that's big enough. Let me increase the size. And I forcefully created a component that looks like what everybody would love with useEffect and a bunch of other things. And then I just ran this against it stock just with the React best practices and it found a bunch of problems. And so you can kind of imagine what this looks like. You can imagine a linter as an agent. That's all it is. So harness it wraps skills, chunks it up like you would with like a code review bot. Gives you the suggested fixes just like a linter. It'll fix them for you. And importantly, you can also run this as a GitHub action. And so, we actually designed this primarily because I wanted to see how hard it would be. And I also want to run a bunch of security tests on every pull request because we found with agents, you can effectively prevent certain classes of vulnerabilities and other concerns as long as you have quite a large budget. And so, you'll see in this case, one thing I implemented was pricing transparency. I don't know if you can read this. This took 5 cents, 6 cents, 7 cents, something like that to run. We'll see how the Neon one's looking and see if it, you know, actually is safe. And by the way, oh no, did I close it? Well, we can pull it up. You know, I was led to believe that there could be a risk in the Neon skills, which is why we chose this as a test. I think you can see this. Oh, no. This thing's in the way. Sorry. We got a couple yellow flags here on Neon. So, I don't know. We'll see if Andre can figure that out. But, we have it running over here. It's going to take too long, but don't worry. I'm great at live demos. And so we already ran this. No issues found. Now granted, this is just a prompt. It's a synthesized prompt from a bunch of research online. If you know what that means, you can figure it out. If not, and the harness adapted it. And what you can see is this took about 2 minutes to run across the whole skill repo there, which does it need to run on all that? No, it doesn't need to run on the SVG probably. I don't know. Some security person could tell me otherwise. It cost us what was it? $2.15. Where do I print it? down at the bottom $2.15 to run this. You can imagine how expensive this could get. I think in a lot of pull requests we count this as like $10 to $20 per run. And so this is not for somebody that's like let me min-max my $200 a month Claude Code subscription and whatnot. This is for like I guess like serious business where you're willing to spend money to not have concerns. But that's it. It's pretty straightforward. If this thing speaks to you, I'd love to talk about it because I think it's a very clever idea. Oh, but we got one. I was hoping this would happen. Probabilistic LLMs. External MCP server connection enables remote instruction loading. Oh, that's true. That's fine. You know, anyways, cool. That's my demo.

Welcome Sentry to the security auditing partnerships. Up next, we have Andre from Neon.

All right. I guess I was introduced already and Neon as well, but I'm going to do an introduction regardless. So, I'm a dev at Neon. We are now a Databricks company. We have a brand new website. It looks awesome. So, check us out. We are you can find us on neon.com. We are serverless Postgres provider and we also on the Vercel marketplace. And naturally, as David already pointed out, I have a skill. We have an agent skill for Neon. I think otherwise I wouldn't be here today. And I don't know what everybody's talking about. Just like it's totally passing, right? So, that's weird. Anyhow, so what is this skill doing? It's exactly doing what you would imagine. It just makes your agents take full advantage of Neon, right? So, Neon has a lot of cool features like branching and autoscaling. Some of them are very easy for you to use because you're just using the Neon connection string. It's Postgres and then you get started. But some of them, you know, with branching for instance, it's great if the agent gets a little bit of steering and information for how to properly use it, right? And that's exactly what the skill is doing. And I have a very simple demo here today to demonstrate this. So when Neon first started, we launched Neon's serverless driver which is a way for you to connect to your Postgres database using HTTP and websocket connections which is really cool if you're on a serverless function just because you don't have to set up a TCP connection which just takes too much time. But since then we've also launched Fluid Compute. Shout out to ourselves, Fluid Compute. It's really awesome. And then we have some other competitors as well that are hosting providers that have long-running connections. For instance like Cloudflare has Hyperdrive. So it's a lot more nuance to how you should connect to Neon now. So this is like a decision tree. It's not really important what it says but you can see based on where you're hosting you should pick a different connection method for Neon. And this is one of those things where there's a lot of nuance and to communicate that to your agents, that's perfect with skills. So, we have a maybe no skill issues demo here. And what it is is just the Next.js app with the Neon skill installed. And I'm going to run just a very simple prompt. This is a new Next app. I plan to host it on Vercel. Right, that's the clue. Please set it up as Neon and Drizzle. And then I have a little joke in here. Who likes to post on Twitter? That's really surprising. I think you guys are lying. Way more of you guys are probably posting on Twitter. Anyhow, so whatever this agent will come up with, it will also tweet it. So you can find me at Andre Landgraf on Twitter and hopefully this agent does well otherwise you can roast me over there. All right. While this is running we can go over here skill issues. So this is what happen if you were just prompting your agent say like hey I want to set up Neon with Drizzle. So this is exactly what would happen. It works. So this code 100% works but you can see it uses the Neon serverless driver which is fine but on Fluid Compute you can actually do pooling now with database pooling and Vercel's attach pooling function so like they have a really nice way now to do pooling it's a little bit faster TCP connections over time can be reused now across different requests and that's just something your agent won't pick up by itself unless it's like steered and hinted a little bit in that direction. So, let's see what the agent here is doing. I have like one more minute otherwise I jump to the final solution. See what it's doing. Config file. Who uses Drizzle here? All right. Shout out to Drizzle. They're awesome. Schema. All right. Come on. Client. Let's go. We're functions package. node-postgres vanilla TCP driver. So this looks perfect. So this is exactly what I wanted to showcase. Not using the Neon serverless driver anymore because on Vercel there's a clever way to do it today and that's the power of skills, right? You can just steer it in the right direction. That's my demo. I'm going to be at the Neon booth if you want to talk to me about serverless Postgres.

Amazing. Up next we have Evan Bacon from Expo.

All right. I'm Evan Bacon. I am the head of AI at Expo. Expo is the number one framework for building mobile apps with AI agents. It's powering beautiful apps such as the new v0 iOS app by Vercel. Expo enables you to go from idea to app store entirely from the command line. It's the only framework that allows that on mobile. And LLMs are very well trained on Expo already. But thanks to agents like Claude Code, the Expo framework is evolving much faster than ever before and all the knowledge that these models are trained on is quickly becoming outdated. For example, we just released Expo Router V7, which has a ton of brand new UI features and components, starting with the new SwiftUI tab bar accessory view in iOS 26. We've also added native gesture-driven shared element transitions. We've expanded the header toolbar buttons and menus to bring you all the beautiful native SwiftUI views. It's liquid glass and I'm noticing now you can really almost not make it out at all on these screens or on your iPhone screen to be honest. We've added a new toolbar API for stationary actions and context items that you can pin to the bottom of each route and this new form sheet that supports footers using the new synchronous React updates in React Native. It'll take probably a while for agents to know about these features by default. But we want to use them today. We want everyone using all of these new features as soon as they come out before they're even released stably in iOS. So that's where skills come in. We just released the official Expo skills for AI agents. These skills can upgrade your app automatically, implement all the new Expo features that I just showed, and help you deploy your app everywhere, App Store, Play Store, wherever you need. These were built around Claude Code because that's my personal favorite agent tool. Skills can be used with any agent tool thanks to the npx skills package. Fantastic package. Made tweeting this easy. Although I think I tweeted this when it was add skills and then you guys changed skills the next day. So yeah, you can use skills obviously with any agent, but I do find that they sort of just work best with whatever agent they were written for. So Claude Code probably your best mileage right now. Here's a quick side by side where I asked Opus to build a social feed and then I added the new Expo skills and I asked it to upgrade the UI, first upgrade the app to the latest Expo and then update the UI. So here we have like sort of a bootstrappy style. Everything's really custom and the floating action button is sort of broken on the left and then on the right it's upgraded everything to proper native views. SwiftUI, SwiftUI header, SwiftUI tab bar, the works. So much of mobile app development is locked behind user interfaces like Xcode and Android Studio. And in Expo, we're making everything headless so that agents can drive. For example, we're actively working on this efficient agent verification with LLDB. That's the debugging library for Xcode. So here's a work in progress skill which can reason about and fix header and keyboard issues by dumping the native tree because there's a lot of private views in there and then giving it to an agent which understands what those private views mean. So issues like keyboard handling which are notoriously the hardest problems in mobile can be solved automatically by an agent. Very exciting for mobile people. And then lastly, not a skill, but in our MCP, you can now ask Claude Code to fix all native iOS crashes that occur in production. This one's pretty sweet as well. You know that old meme of like if you want that native feel in a website, just do like on error and then like window.close. Very frustrating when your app just crashes, but Apple actually reports all these errors in a way that developers can access. But it's hidden behind many layers of GUIs. So now you can just install the MCP and say fix every problem in my app and it will aggregate them, collect them, find any feedback and then collect the stack traces and start fixing them one by one. We've been using this for our app Expo Go. It's a top 10 app and it fixes every single issue as it occurs now. So pretty sweet. And later this month we will be announcing more agentic tools to enable you to iterate even faster. Build from any sort of surface, more agents, make everything feel like a forward deployed engineer is right there in your codebase. So stay tuned, follow us on X for more at expo or baconbricks and thank you.

Thank you, Evan. Speaking of Stably, we have Neil from stably.ai.

Hello. I was noticing there's this skill sticker on the front. I just wonder if they keep putting new ones on. Like if you dig deep enough, is there like the original Next.js sticker? It's like in the back of your license plate. Hey everyone, I'm Neil, co-founder and CTO of Stably. We are an AI testing platform. So we build agents that run in your CI that automatically build, run, and maintain end-to-end tests. That's what we do. But that's not what I'm going to talk to you about. I'm actually going to talk about if you use Slack a lot like us. We actually built something called Agent Slack. And it just lets your cloud code, whatever you're using, use Slack. And I'm just going to show that. And so I can do a little live demo if people like that. Otherwise, I'll show examples. But, you know, you all have got that person on your team that sends you a message. You know, maybe you don't want to actually read the 12 replies. So, you can just go in and you can just say like, 'Hey, I'm going to say summarize.' And you can just paste in the URL that you get.

What's up?

I do not have the build. Oh. Oh. Oh, with a text. Okay. You're right. Thank you. All right, cool. So, yeah, it will tell you what the summary is. In this case, it was, yeah, a recipe for chocolate covered French fries, which everyone loves. And otherwise, you'd have to read a long thread. So, now you don't need to. And that's a basic showcase. So, you can put in, you know, a thread or even a canvas. Canvas are just markdown underneath, so it can read those. And I'm just going to showcase some other things. You can be a little more creative. This is something that we did. We have obviously users in Slack. We have users in GitHub and we wanted a mapping between them for like task creation stuff from Slack. And so you can just tell it to do that for you and it can find the users and like it's honestly smart enough your AI where it's like okay I'm going to look into these and match all the users. And it can do search and we've found that oftentimes this is better than Slack's AI search. No hate, but I think Slack is a little to improve there. You can also just be really lazy and you can just say like, 'Hey, take care of this.' Then you can walk away from your computer and it might send a message on your behalf. They don't need to know. And then the example I gave was just me telling it as well to make a long thread of the chocolate covered French fries. So you can just do stupid things as well. So it's very flexible. And this is how do you know your skill is useful? In our case, somebody from Salesforce started a repo. So I guess if they're using it internally, maybe it's useful. So that's what I got. So thanks everyone. You can install the skill MPX skills ad.

Nice work. Now we have Harold from GitHub Microsoft.