vercel-labs / agentic-commerce-skills

The one skill, ucp, is invoked with a sub-command — init, consult, plan, gaps, scaffold, validate, profile, test, or docs — and each does a distinct job: consult reads an existing codebase and reports what it already does toward UCP compliance, gaps runs an AST-based analysis to name what's missing, scaffold writes UCP-compliant checkout routes for the Next.js App Router, and validate checks the result against the spec. Rather than working from memory of the protocol, the skill clones the spec's own repository (Universal-Commerce-Protocol/ucp on GitHub) into a local .ucp-spec/ folder and reads the canonical markdown and JSON Schema files from there, updating that clone on later runs.

This is for a team already building or migrating checkout in Next.js on Vercel that wants an agent working from the actual UCP specification — REST, MCP, and A2A checkout flows, payment tokenization, capability negotiation between merchant and client — instead of one improvising the protocol from partial memory. The skill explicitly refuses to touch the Edge runtime, requiring plain Node.js or an opt-in Bun runtime instead.

READ THE FULL ANALYSIS＋

What it eventually asks you to provide. The skill's own credential-handling section calls for environment variables rather than anything stored in its config file: a payment handler like Stripe needs STRIPE_SECRET_KEY, and the protocol's own identity flow needs UCP_SIGNING_KEY and an OAuth client id and secret. That is consistent with our capability check classifying this skill as needing a stored account key, even though none of that is required just to run the read-only sub-commands like consult or gaps.

There is no README for this repository, and no license file. The entire repository is one file, ucp/SKILL.md — everything above came from reading that file directly, since our normal package bundle for this repo had nothing to draw on beyond the skill's own one-line description.