Deepsec

vercel-labs/deepsec

Use deepsec (an AI-powered vulnerability scanner) — running scans, configuring projects, writing matchers, and authoring plugins. Activates when the user asks how to scan, configure, or extend deepsec in a project that has deepsec installed.

99k tokens

context cost

the whole folder, loaded on every use

files

ships runnable scripts

copies elsewhere

how many repositories repackaged it

6527

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/vercel-labs/deepsec --skill deepsec

What comes with it

244 447 bytes besides the instruction

.gitignore

build.mjs

package.json

src/__tests__/agent-config.test.ts

src/__tests__/agent-defaults.test.ts

src/__tests__/credential-brokering.test.ts

src/__tests__/file-sources.test.ts

src/__tests__/formatters.test.ts

src/__tests__/merge-records.test.ts

src/__tests__/metrics.test.ts

src/__tests__/network-policy.test.ts

src/__tests__/output-cap.test.ts

src/__tests__/pr-comment.test.ts

src/__tests__/preflight.test.ts

src/__tests__/resolve-agent-type.test.ts

src/__tests__/resolve-project-id.test.ts

src/__tests__/sandbox-tools.test.ts

src/__tests__/tarball.test.ts

src/agent-config.ts

src/agent-defaults.ts

src/cli.ts

src/commands/enrich.ts

src/commands/export.ts

src/commands/init-project.ts

src/commands/init.ts

src/commands/metrics.ts

src/commands/process.ts

src/commands/report.ts

src/commands/revalidate.ts

src/commands/sandbox-all.ts

src/commands/sandbox-process.ts

src/commands/scan.ts

src/commands/status.ts

src/commands/triage.ts

src/config.ts

src/data-commit.ts

src/file-sources.ts

src/formatters.ts

src/load-config.ts

src/output-cap.ts

The instruction itself

4 sections, as written by the author

deepsec

deepsec is an AI-powered vulnerability scanner. This skill activates

when deepsec ships inside node_modules/ — typically because the user

ran npx deepsec … (which caches the package locally). In the more

common dedicated-git setup the user works inside a clone of

vercel-labs/deepsec and the same docs sit at docs/ from the repo root —

read those instead when this skill fires from outside a node_modules.

When the user asks how to use, configure, or extend deepsec, read the

relevant doc before answering — the docs are the source of truth, not

your training data.

Where the docs are

node_modules/deepsec/dist/docs/ (or <deepsec-clone>/docs/):

getting-started.md — first-scan walkthrough
configuration.md — full deepsec.config.ts reference
plugins.md — plugin slots (matchers, notifiers, ownership, people, executor)
writing-matchers.md — how to grow the matcher set with a coding agent
models.md — model selection, defaults, refusals, future models
vercel-setup.md — getting AI Gateway and Vercel Sandbox keys / tokens
architecture.md — pipeline internals
data-layout.md — data/ schemas (FileRecord, RunMeta, …)
faq.md — cost, model choice, sandbox mode, FP rate

Worked example

node_modules/deepsec/dist/samples/webapp/ (or <deepsec-clone>/samples/webapp/)

is a complete reference setup — deepsec.config.ts with an inline

plugin, two custom matchers under matchers/, an INFO.md for AI

prompt context, and a per-project config.json. When the user asks

"what should my config look like?", read this directory.

How to answer common questions

"How do I run a scan?" → getting-started.md.
"What goes in deepsec.config.ts?" → configuration.md + samples/webapp/deepsec.config.ts.
"How do I add a matcher?" → writing-matchers.md + samples/webapp/matchers/*.ts.
"How do I write a plugin?" → plugins.md + samples/webapp/deepsec.config.ts (inline plugin pattern).
"What does deepsec actually do?" → architecture.md.
"What's in data/<id>/files/foo.json?" → data-layout.md.
"Which model / agent should I use?" → models.md.
"How do I get an AI Gateway / Sandbox token?" → vercel-setup.md.

Read the doc before paraphrasing. The CLI flag set, defaults, and

plugin-contract field names change — quote the doc, don't recall.

How to use it

Copy the folder

Take vercel-labs/deepsec from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.

Install what it needs

The instructions reference npx. Without those the skill loads but fails at the first command.