Telemetry

Anonymous usage tracking and how to disable it

The Skills CLI collects anonymous usage data to help improve the tool. No personal information or skill contents are collected.

Telemetry is automatically disabled in CI environments and can be disabled manually via environment variables.

---

What Data is Collected

The CLI tracks these events:

Install Event

Tracked when skills are installed via skills add

Data Structure

{
  event: 'install',
  source: 'vercel-labs/agent-skills',  // Repository/source
  skills: '3',                          // Number of skills installed
  agents: 'claude-code,cursor',        // Target agents (comma-separated)
  global: '1',                         // 1 if --global flag used
  skillFiles: '{...}',                 // JSON map of skill name → path
  sourceType: 'github',                // Source type (github, local, etc.)
  v: '1.2.3',                          // CLI version
  ci: '0'                              // 1 if running in CI
}

Remove Event

Tracked when skills are removed via skills remove

Data Structure

{
  event: 'remove',
  source: 'vercel-labs/agent-skills',  // Repository (if known)
  skills: '2',                          // Number of skills removed
  agents: 'cursor',                    // Target agents
  global: '1',                         // 1 if --global flag used
  sourceType: 'github',                // Source type
  v: '1.2.3',                          // CLI version
  ci: '0'                              // 1 if running in CI
}

Check Event

Tracked when checking for updates via skills check

Data Structure

{
  event: 'check',
  skillCount: '5',           // Number of skills checked
  updatesAvailable: '2',     // Number of updates found
  v: '1.2.3',               // CLI version
  ci: '0'                   // 1 if running in CI
}

Update Event

Tracked when updating skills via skills update

Data Structure

{
  event: 'update',
  skillCount: '2',      // Number of skills with updates
  successCount: '2',    // Number successfully updated
  failCount: '0',       // Number that failed to update
  v: '1.2.3',          // CLI version
  ci: '0'              // 1 if running in CI
}

Find Event

Tracked when searching for skills via skills find

Data Structure

{
  event: 'find',
  query: 'typescript',   // Search query (if provided)
  resultCount: '12',     // Number of results found
  interactive: '1',      // 1 if interactive mode used
  v: '1.2.3',           // CLI version
  ci: '0'               // 1 if running in CI
}

Sync Event

Tracked when syncing skills from node_modules via skills experimental_sync

Data Structure

{
  event: 'experimental_sync',
  skillCount: '8',       // Number of skills found
  successCount: '8',     // Number successfully synced
  agents: 'cursor',      // Target agents
  v: '1.2.3',           // CLI version
  ci: '0'               // 1 if running in CI
}

---

What is NOT Collected

The following data is never collected:

• Personal information (name, email, IP address)
• Skill file contents
• Local file paths (only skill names and counts)
• Repository contents
• Authentication tokens
• Environment variables (except telemetry opt-out flags)

---

How Telemetry Works

Implementation

Telemetry is implemented in src/telemetry.ts:

1. Check if enabled

   Verify telemetry is not disabled via environment variables or CI detection

2. Build request

   Construct a URL with event data as query parameters

3. Fire and forget

   Send a GET request to the telemetry endpoint (non-blocking, errors silently ignored)

Endpoint

Telemetry URL

https://add-skill.vercel.sh/t

Request Format

Telemetry is sent as URL query parameters:

Example Request

GET https://add-skill.vercel.sh/t?event=install&source=vercel-labs%2Fagent-skills&skills=3&agents=cursor&v=1.2.3&ci=0

---

Automatic CI Detection

Telemetry is automatically disabled when running in CI environments.

Detected CI Platforms

The CLI checks for these environment variables:

CI

CI=true

GitHub Actions

GITHUB_ACTIONS=true

GitLab CI

GITLAB_CI=true

CircleCI

CIRCLECI=true

Travis CI

TRAVIS=true

Buildkite

BUILDKITE=true

Jenkins

JENKINS_URL set

TeamCity

TEAMCITY_VERSION set

CI Flag

When running in CI, events include ci=1 in the telemetry data (if telemetry is manually enabled).

---

Disabling Telemetry

You can disable telemetry in two ways:

Option 1: DISABLE_TELEMETRY

Temporary

DISABLE_TELEMETRY=1 npx skills add vercel-labs/agent-skills

echo 'export DISABLE_TELEMETRY=1' >> ~/.bashrc
source ~/.bashrc

set -Ux DISABLE_TELEMETRY 1

Option 2: DO_NOT_TRACK

Temporary

DO_NOT_TRACK=1 npx skills add vercel-labs/agent-skills

echo 'export DO_NOT_TRACK=1' >> ~/.bashrc
source ~/.bashrc

set -Ux DO_NOT_TRACK 1

Both environment variables have the same effect. Use whichever you prefer or is already set by other tools.

---

Security Audit Telemetry

In addition to usage telemetry, the CLI fetches security audit data from a separate API when installing skills.

Audit API

Audit URL

https://add-skill.vercel.sh/audit

Request Format

Example Request

GET https://add-skill.vercel.sh/audit?source=vercel-labs%2Fagent-skills&skills=frontend-design,skill-creator

Response Format

Audit Response

{
  "vercel-labs/agent-skills": {
    "frontend-design": {
      "risk": "safe",
      "alerts": 0,
      "score": 100,
      "analyzedAt": "2024-01-15T10:30:00.000Z"
    },
    "skill-creator": {
      "risk": "low",
      "alerts": 1,
      "score": 85,
      "analyzedAt": "2024-01-15T10:30:00.000Z"
    }
  }
}

Risk Levels

Safe

No security concerns detected

Low

Minor concerns, generally safe

Medium

Some concerns, review recommended

High

Significant concerns, caution advised

Critical

Severe concerns, installation not recommended

Unknown

No audit data available

Timeout

Audit requests timeout after 3 seconds to avoid blocking installations. If the API doesn’t respond in time, the installation proceeds without audit data.

Audit data is informational only and never blocks installations. You can always install skills regardless of risk level.

---

Source Code Reference

The telemetry implementation is in src/telemetry.ts:

Key Functions

import { track, fetchAuditData, setVersion } from './telemetry';

// Set CLI version (tracked with all events)
setVersion('1.2.3');

// Track an event
track({
  event: 'install',
  source: 'vercel-labs/agent-skills',
  skills: '3',
  agents: 'cursor',
  sourceType: 'github'
});

// Fetch security audit data
const auditData = await fetchAuditData(
  'vercel-labs/agent-skills',
  ['frontend-design', 'skill-creator'],
  3000  // timeout in ms
);

API Reference

track · function

Track a telemetry event

Show Signature

function track(data: TelemetryData): void

data · TelemetryData · required

Event data object (see event types above)

returns · void

No return value (fire and forget)

fetchAuditData · function

Fetch security audit data for skills

Show Signature

async function fetchAuditData(
  source: string,
  skillSlugs: string[],
  timeoutMs?: number
): Promise<AuditResponse | null>

source · string · required

Repository identifier (e.g., "owner/repo")

skillSlugs · string[] · required

Array of skill names to audit

timeoutMs · number

Request timeout in milliseconds (default: 3000)

returns · AuditResponse | null

Audit data or null on error/timeout

setVersion · function

Set CLI version for telemetry tracking

Show Signature

function setVersion(version: string): void

version · string · required

CLI version string (e.g., "1.2.3")

---

Privacy Commitment

The Skills CLI is committed to user privacy:

Open Source

All telemetry code is open source and auditable on GitHub

No PII

No personally identifiable information is ever collected

Opt-Out

Easy to disable via environment variables

Non-Blocking

Telemetry failures never affect CLI functionality

---

Related Documentation

Environment Variables

See all environment variables, including telemetry controls

Update System

Learn how update checks send telemetry data