external/vercel-python/SKILL.md
Diagnose, fix, and prepare Python projects for Vercel deployments. Use for FastAPI, Flask, Django, ASGI/WSGI, Python entrypoints, pyproject.toml, requirements.txt, uv, .python-version, bundle size, Python runtime errors, or Vercel's Python SDK/runtime APIs. Use this skill whenever the user mentions Python and Vercel in the same context, even if they don't explicitly ask for deployment help.
npx skillsauth add seikaikyo/dash-skills vercel-pythonInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Use this skill when a Vercel deployment involves Python, including FastAPI, Flask, Django, generic ASGI/WSGI apps, Python runtime diagnostics, dependency resolution, Python version selection, bundle size issues, or the vercel Python SDK.
This skill diagnoses and fixes Python-specific deployment issues. It does not handle the deployment itself.
Inspect the project structure before changing any files. Check the following:
Entrypoint: Identify the app entrypoint and confirm it exposes a supported top-level callable (app, application, or handler). The entrypoint priority is: [tool.vercel].entrypoint in pyproject.toml, then framework-specific discovery (Django uses the settings module; others use conventional files like app.py, main.py, etc.), then [project.scripts].app (legacy). For Django projects, if manage.py exists at the root or one directory below, check that the settings module defines ASGI_APPLICATION or WSGI_APPLICATION. See references/runtime-and-entrypoints.md for full details.
Dependencies: Identify the dependency manifest. Vercel discovers manifests from the entrypoint directory upward to the project root. The highest-priority manifest wins: pyproject.toml > Pipfile.lock / Pipfile > requirements.txt (and variants like requirements.frozen.txt, requirements.in, requirements/prod.txt). Check for a lockfile: uv.lock or pylock.toml (used with pyproject.toml projects). See references/dependencies-and-versions.md for the full priority list.
Bundle size: Vercel Python functions support up to 500 MB. Do not use 250 MB as the limit. When a uv.lock is present, the builder can automatically externalize large public PyPI packages and install them at cold start, allowing even larger dependency sets. See references/dependencies-and-versions.md for size reduction strategies.
Python version: Check .python-version (takes priority) and project.requires-python in pyproject.toml. Vercel supports Python 3.12, 3.13, and 3.14 for new projects. Only flag a version as blocking if it excludes all supported versions (e.g., ==3.11.*, <3.12, >=3.15). A range like >=3.11 is fine because it includes 3.12+.
Database: If the project requires a database (PostgreSQL, MySQL, etc.), note that Vercel Marketplace provides managed database integrations (Neon Postgres, Supabase, AWS RDS) that automatically set connection environment variables. Do not assume the app cannot connect to a database on Vercel. See references/frameworks.md for details.
Vercel config: If vercel.json exists, check for custom buildCommand or installCommand (these can limit dependency optimization).
Monorepo: If the Python app is in a subdirectory of a monorepo, confirm rootDirectory is set correctly in the Vercel project settings. The builder resolves uv.lock from the workspace root automatically for uv workspace projects.
Background workers: If the project uses task queues, background jobs, or event-driven workers (Celery, Dramatiq, Django tasks, or similar), check references/frameworks.md for Vercel's worker service support via the vercel-workers package. Do not assume background processing is incompatible with Vercel.
Identify blockers and risks from what you found:
manage.py.[tool.vercel].entrypoint).Read only the reference file that matches the problem:
references/runtime-and-entrypoints.mduv, and Python versions: references/dependencies-and-versions.mdreferences/frameworks.mdreferences/troubleshooting.mdreferences/sdk-runtime-apis.mdMake the smallest safe project change that addresses the root cause, or give the user exact remediation when credentials, missing env vars, or account state block progress.
Verify. Re-check the project against the same checklist from step 1. Confirm that no blocking findings remain and all risks have been documented or addressed.
This skill's job is done when the Python project has no blocking deployment issues. It does not handle deployment, auth, environment variables, domains, or logs.
Do not accept these conclusions without checking the reference docs first:
| Claim | Reality |
|---|---|
| "The bundle is too large for Vercel" | The limit is 500 MB, not 250 MB. With uv.lock, the builder externalizes public packages beyond that. |
| "This app requires a database, so it can't deploy to Vercel" | Vercel Marketplace provides Neon Postgres, Supabase, and AWS RDS integrations. |
| "Background processing is impossible on Vercel" | Vercel supports worker services via vercel-workers with Celery, Dramatiq, and Django task adapters. |
| "Vercel doesn't support uv workspaces or monorepos" | It does. The builder resolves uv.lock from the workspace root. |
| "This entrypoint path isn't supported" | Any path works with [tool.vercel].entrypoint in pyproject.toml. |
| "Python version X.Y isn't compatible" | Only blocking if the range excludes all of 3.12, 3.13, and 3.14. Ranges like >=3.11 are fine. |
Lead with the concrete blocker or readiness status:
I inspected the Python project. Vercel should use `app/main.py` as the entrypoint with `app` as the ASGI callable. No blocking issues found.
When several findings exist, group them by deployment impact:
references/runtime-and-entrypoints.md.uv, lockfile, or Python version issues: inspect references/dependencies-and-versions.md.collectstatic issues: inspect references/frameworks.md.PYTHON_ENTRYPOINT_NOT_FOUND, PYTHON_HANDLER_NOT_FOUND, DJANGO_SETTINGS_FAILED, PYTHON_REQUIREMENTS_PARSE_ERROR, PYTHON_DEPENDENCY_SYNC_FAILED, or LAMBDA_SIZE_EXCEEDED: inspect references/troubleshooting.md.references/sdk-runtime-apis.md.tools
Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of processing, lawful basis validation, data subject rights implementation, Data Protection Impact Assessments (DPIAs) under Article 35, breach notification procedures, international transfer safeguards (SCCs, adequacy decisions), and technical/organizational measures under Article 32. Use when processing personal data of EU residents, preparing for supervisory authority audits, implementing privacy-by-design for new systems, scoping compliance gaps for M&A due diligence, assessing third-party processors, or responding to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB, and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR automation — use implementing-gdpr-data-subject-access-request.
tools
Parse Windows forensic artifacts—$MFT/$J (MFTECmd), Prefetch (PECmd), registry hives (RECmd), shellbags, and Amcache—into normalized CSV/JSON with Eric Zimmerman's EZ Tools, then load results into Timeline Explorer for analysis. Use during DFIR/incident-response investigations, after triage collection (e.g. with KAPE), to establish program execution, file/folder access, and persistence evidence from acquired forensic images.
development
Build automated multi-turn adversarial attacks against conversational LLM targets using Microsoft PyRIT's RedTeamingOrchestrator, CrescendoOrchestrator (gradual escalation), and TreeOfAttacksWithPruningOrchestrator (adaptive branching), with scorer feedback loops and persisted conversation memory. Use when single-shot LLM scanning is insufficient and you need multi-turn, scorer-driven AI red-team campaigns against a chatbot or agent.
testing
Stand up MISP, enable and cache curated threat feeds (CIRCL, abuse.ch, Feodo Tracker), apply warninglists to suppress false positives, query indicators with PyMISP, and export attributes as auto-generated Suricata/Sigma/Wazuh detection rules. Use when maturing a MISP instance to actively drive detection, curating threat feeds with quality controls, or automating IOC-to-detection pipelines for the SIEM/IDS.