Opus finding
Build skill instructs `vercel --prod` without secret/env hygiene guidance
mediumsecuritymedium
- .claude/skills/build.md:38-39
An autonomous agent shipping a wallet-connect / on-chain launchpad to production via `vercel --prod` with no checklist for: which env vars must be configured (Privy app id, RPC URL, IPFS keys), which must NOT be bundled client-side (private signing keys), and whether the deploy should be preview-first. This is a recipe for accidentally publishing a build that includes a server-side key in the client bundle or that fails to set required env vars and serves a broken/dangerous UI. Step 6 also mentions exposing 'launchpad fee income' which could include the agent wallet — fine — but no constraint against exposing the FeeLocker private key path.
Recommendation
Add an explicit pre-deploy checklist: enumerate required env vars, require `vercel` preview deploy + smoke test before `--prod`, and add a build-time grep for known secret-name patterns in `.next/static/**`.