PreToolUse skill-injection hook fires on any project with matching basename, not just Vercel projects

Summary

The Vercel plugin's PreToolUse hook (hooks/pretooluse-skill-inject.mjs) matches on file basename alone (README*, package.json, tsconfig.json, etc.) without checking whether the current project is actually a Vercel/Next.js project. The result: in a non-Vercel project (e.g. a Bun CLI, a generic Node tool, a Rust binary that happens to have a README.md), every Write/Edit on a matching filename triggers a MANDATORY: Your training data for these libraries is OUTDATED injection that tells the agent to invoke Skill(bootstrap) / Skill(next-upgrade) / Skill(nextjs) — irrelevant to the project at hand.

Steps to reproduce

1. Create a non-Vercel project: mkdir my-cli && cd my-cli && git init && bun init -y
2. In a Claude Code session, Write a README.md (or package.json, or tsconfig.json)
3. Observe the PreToolUse hook injecting Vercel/Next.js skill guidance even though the project has no vercel.json, no next.config.*, no @vercel/* dependency, no next dependency

Expected

The hook should run the same project-type detection that session-start-profiler.mjs already does (looks for vercel.json, next.config.{js,ts,mjs,mts}, @vercel/* / next in package.json deps) and early-exit when none match.

Concretely

A guard like the one in session-start-profiler.mjs:profileProject() applied at the top of pretooluse-skill-inject.mjs before any basename matching would solve it. Same detection logic, just lifted into the per-file hook.

Impact

Every file write in a non-Vercel project triggers a MANDATORY instruction the agent must explicitly override. For a multi-file scaffold (e.g. spinning up a new repo) that's 5-15 false-positive prompts per session, adding tokens and noise. Acknowledging each one in narration is a poor user experience.

Context

Plugin version: 0.32.4 (current as of 2026-05-27)
Observed on: macOS, Claude Code with claude-plugins-official marketplace.

Filed by an end user via Claude Code after the false-positive fired on every file of a Bun CLI scaffold. Happy to PR if useful.

Start in hooks/pretooluse-skill-inject.mjs and compare its project checks with profileProject() in session-start-profiler.mjs. Apply the existing Vercel/Next.js detection before basename matching, then reproduce the Bun CLI case to confirm matching files no longer trigger injections while Vercel projects still do.