UserPromptSubmit skill-injection fires on bare keyword matches in non-Vercel projects

The user-prompt-submit-skill-inject hook injects MANDATORY skill-invocation directives based on single-keyword matches ("workflow", "verification", "chain", "deploy") with no project-relevance check.

In a local-only Python project (no vercel.json, no next.config.*, no Vercel dependencies — not a web app at all), it fired 8+ times in one working session. Each injection instructed the model it "must" run Vercel skills (Skill(workflow), Skill(verification), Skill(vercel-cli), Skill(bootstrap)), which contradicts the plugin's own session-context rule: "Use Vercel guidance only when the current repo, prompt, or tool call makes it relevant."

Example trigger from the session: the word "workflow" in a prompt about a local Python eval loop matched allOf [workflow, run] +4 and injected the full MANDATORY block with documentation links.

Suggested fix: gate injection on repository signals (presence of vercel.json / next.config.* / package.json with Vercel-ecosystem deps, or a linked Vercel project) before keyword scoring runs. The keyword matcher is a reasonable second stage, but as a first stage it produces a high false-positive rate in any agentic-tooling codebase, since words like "workflow" and "deploy" are generic.

Also observed: the plugin ended up installed twice via different marketplaces (vercel@claude-plugins-official 0.43.0 and vercel-plugin@vercel-vercel-plugin 0.32.0), doubling some injections. A dedupe warning at install time might be worth it.

Happy to provide the full trigger log from the session.

(Context: hit this while building a local agentic-coding stack — reachable at veeti.hietasalo@gmail.com if useful to discuss.)

Start at the user-prompt-submit-skill-inject hook and trace how repository context is gathered before keyword scoring. Verify that generic matches such as “workflow” and “deploy” do not inject Vercel skills in non-Vercel projects, while relevant repositories still trigger them; also inspect installation handling for duplicate marketplace plugins and the reported dedupe warning.