Telemetry - Skills

The Skills CLI collects anonymous usage data to help improve the tool. No personal information or skill contents are collected.

Telemetry is automatically disabled in CI environments and can be disabled manually via environment variables.

What Data is Collected

The CLI tracks these events:

Install Event

Tracked when skills are installed via skills add

{
  event: 'install',
  source: 'vercel-labs/agent-skills',  // Repository/source
  skills: '3',                          // Number of skills installed
  agents: 'claude-code,cursor',        // Target agents (comma-separated)
  global: '1',                         // 1 if --global flag used
  skillFiles: '{...}',                 // JSON map of skill name → path
  sourceType: 'github',                // Source type (github, local, etc.)
  v: '1.2.3',                          // CLI version
  ci: '0'                              // 1 if running in CI
}

Remove Event

Tracked when skills are removed via skills remove

{
  event: 'remove',
  source: 'vercel-labs/agent-skills',  // Repository (if known)
  skills: '2',                          // Number of skills removed
  agents: 'cursor',                    // Target agents
  global: '1',                         // 1 if --global flag used
  sourceType: 'github',                // Source type
  v: '1.2.3',                          // CLI version
  ci: '0'                              // 1 if running in CI
}

Check Event

Tracked when checking for updates via skills check

{
  event: 'check',
  skillCount: '5',           // Number of skills checked
  updatesAvailable: '2',     // Number of updates found
  v: '1.2.3',               // CLI version
  ci: '0'                   // 1 if running in CI
}

Update Event

Tracked when updating skills via skills update

{
  event: 'update',
  skillCount: '2',      // Number of skills with updates
  successCount: '2',    // Number successfully updated
  failCount: '0',       // Number that failed to update
  v: '1.2.3',          // CLI version
  ci: '0'              // 1 if running in CI
}

Find Event

Tracked when searching for skills via skills find

{
  event: 'find',
  query: 'typescript',   // Search query (if provided)
  resultCount: '12',     // Number of results found
  interactive: '1',      // 1 if interactive mode used
  v: '1.2.3',           // CLI version
  ci: '0'               // 1 if running in CI
}

Sync Event

Tracked when syncing skills from node_modules via skills experimental_sync

{
  event: 'experimental_sync',
  skillCount: '8',       // Number of skills found
  successCount: '8',     // Number successfully synced
  agents: 'cursor',      // Target agents
  v: '1.2.3',           // CLI version
  ci: '0'               // 1 if running in CI
}

What is NOT Collected

The following data is never collected:

Personal information (name, email, IP address)
Skill file contents
Local file paths (only skill names and counts)
Repository contents
Authentication tokens
Environment variables (except telemetry opt-out flags)

How Telemetry Works

Implementation

Telemetry is implemented in src/telemetry.ts:

Check if enabled

Verify telemetry is not disabled via environment variables or CI detection

Build request

Construct a URL with event data as query parameters

Fire and forget

Send a GET request to the telemetry endpoint (non-blocking, errors silently ignored)

Endpoint

https://add-skill.vercel.sh/t

Request Format

Telemetry is sent as URL query parameters:

GET https://add-skill.vercel.sh/t?event=install&source=vercel-labs%2Fagent-skills&skills=3&agents=cursor&v=1.2.3&ci=0

Automatic CI Detection

Telemetry is automatically disabled when running in CI environments.

Detected CI Platforms

The CLI checks for these environment variables:

CI

CI=true

GitHub Actions

GITHUB_ACTIONS=true

GitLab CI

GITLAB_CI=true

CircleCI

CIRCLECI=true

Travis CI

TRAVIS=true

Buildkite

BUILDKITE=true

Jenkins

JENKINS_URL set

TeamCity

TEAMCITY_VERSION set

CI Flag

When running in CI, events include ci=1 in the telemetry data (if telemetry is manually enabled).

Disabling Telemetry

You can disable telemetry in two ways:

Option 1: DISABLE_TELEMETRY

DISABLE_TELEMETRY=1 npx skills add vercel-labs/agent-skills

Option 2: DO_NOT_TRACK

DO_NOT_TRACK=1 npx skills add vercel-labs/agent-skills

Both environment variables have the same effect. Use whichever you prefer or is already set by other tools.

Security Audit Telemetry

In addition to usage telemetry, the CLI fetches security audit data from a separate API when installing skills.

Audit API

https://add-skill.vercel.sh/audit

Request Format

GET https://add-skill.vercel.sh/audit?source=vercel-labs%2Fagent-skills&skills=frontend-design,skill-creator

Response Format

{
  "vercel-labs/agent-skills": {
    "frontend-design": {
      "risk": "safe",
      "alerts": 0,
      "score": 100,
      "analyzedAt": "2024-01-15T10:30:00.000Z"
    },
    "skill-creator": {
      "risk": "low",
      "alerts": 1,
      "score": 85,
      "analyzedAt": "2024-01-15T10:30:00.000Z"
    }
  }
}

Risk Levels

Safe

No security concerns detected

Low

Minor concerns, generally safe

Medium

Some concerns, review recommended

High

Significant concerns, caution advised

Critical

Severe concerns, installation not recommended

Unknown

No audit data available

Timeout

Audit requests timeout after 3 seconds to avoid blocking installations. If the API doesn’t respond in time, the installation proceeds without audit data.

Audit data is informational only and never blocks installations. You can always install skills regardless of risk level.

Source Code Reference

The telemetry implementation is in src/telemetry.ts:

import { track, fetchAuditData, setVersion } from './telemetry';

// Set CLI version (tracked with all events)
setVersion('1.2.3');

// Track an event
track({
  event: 'install',
  source: 'vercel-labs/agent-skills',
  skills: '3',
  agents: 'cursor',
  sourceType: 'github'
});

// Fetch security audit data
const auditData = await fetchAuditData(
  'vercel-labs/agent-skills',
  ['frontend-design', 'skill-creator'],
  3000  // timeout in ms
);

API Reference

track

function

Track a telemetry event

Show Signature

function track(data: TelemetryData): void

data

TelemetryData

required

Event data object (see event types above)

returns

void

No return value (fire and forget)

fetchAuditData

function

Fetch security audit data for skills

Show Signature

async function fetchAuditData(
  source: string,
  skillSlugs: string[],
  timeoutMs?: number
): Promise<AuditResponse | null>

source

string

required

Repository identifier (e.g., "owner/repo")

skillSlugs

string[]

required

Array of skill names to audit

timeoutMs

number

Request timeout in milliseconds (default: 3000)

returns

AuditResponse | null

Audit data or null on error/timeout

setVersion

function

Set CLI version for telemetry tracking

Show Signature

function setVersion(version: string): void

version

string

required

CLI version string (e.g., "1.2.3")

Privacy Commitment

The Skills CLI is committed to user privacy:

Open Source

All telemetry code is open source and auditable on GitHub

No PII

No personally identifiable information is ever collected

Opt-Out

Easy to disable via environment variables

Non-Blocking

Telemetry failures never affect CLI functionality

Environment Variables

See all environment variables, including telemetry controls

Update System

Learn how update checks send telemetry data

Get Started

Core Commands

Guides

Advanced

Resources

Documentation Index

​What Data is Collected

​What is NOT Collected

​How Telemetry Works

​Implementation

​Endpoint

​Request Format

​Automatic CI Detection

​Detected CI Platforms

CI

GitHub Actions

GitLab CI

CircleCI

Travis CI

Buildkite

Jenkins

TeamCity

​CI Flag

​Disabling Telemetry

​Option 1: DISABLE_TELEMETRY

​Option 2: DO_NOT_TRACK

​Security Audit Telemetry

​Audit API

​Request Format

​Response Format

​Risk Levels

Safe

Low

Medium

High

Critical

Unknown

​Timeout

​Source Code Reference

​API Reference

​Privacy Commitment

Open Source

No PII

Opt-Out

Non-Blocking

​Related Documentation

Environment Variables

Update System

Build docs developers (and LLMs) love

What Data is Collected

What is NOT Collected

How Telemetry Works

Implementation

Endpoint

Request Format

Automatic CI Detection

Detected CI Platforms

CI Flag

Disabling Telemetry

Option 1: DISABLE_TELEMETRY

Option 2: DO_NOT_TRACK

Security Audit Telemetry

Audit API

Request Format

Response Format

Risk Levels

Timeout

Source Code Reference

API Reference

Privacy Commitment

Related Documentation