'vercel integration add neon' drops Neon agent skills into agent/skills/, and eve loads them into the OpenInstinct agent

[fmhall]

Expected Behavior

Provisioning the Neon marketplace resource should not change what skills the shipped assistant has.

Current Behavior

vercel integration add neon … (the CLI equivalent of the deploy button's Neon step) finishes with "Installing agent skills for Neon... Installed 2 agent skills for Neon" and writes:

• agent/skills/neon/SKILL.md (+ agent/skills/neon/references/*)
• agent/skills/neon-postgres/SKILL.md
• a root skills-lock.json

Because eve scans agent/skills/ (node_modules/eve/docs/skills.mdx), the personal assistant now advertises a "Neon / Lakebase Postgres" skill to the model on every turn. Nothing in the repo ignores, lints, or warns about this, so anyone following the CLI path will commit it without noticing — and the iMessage assistant quietly gains a database-administration skill.

Possible Solution

• Add agent/skills/neon* and skills-lock.json to .gitignore, and/or make pnpm check (knip / a conformance rule) fail when unexpected directories appear under agent/skills/.
• Document vercel integration add neon --no-skills style opt-out if the Vercel CLI offers one, or a one-line "delete these after provisioning" note in the README.
• Longer term, keep product skills in a namespaced directory so third-party installers can't land in the agent's skill set.

Minimal Reproducible Example

1. vercel link --project <fresh>
2. vercel integration add neon --plan <plan> -m region=iad1 -m auth=false --non-interactive
3. git status → untracked agent/skills/neon, agent/skills/neon-postgres, skills-lock.json

Context

Provisioning a fresh open-instinct3 project from the CLI on 2026-08-27; only noticed via git status before pulling upstream.