Deepsec Agent Skill

Use deepsec (an AI-powered vulnerability scanner) — running scans, configuring projects, writing matchers, and authoring plugins. Activates when the user asks how to scan, configure, or extend deepsec in a project that has deepsec installed.

99k tokens

context cost

the whole folder, loaded on every use

files

ships runnable scripts

copies elsewhere

how many repositories repackaged it

6527

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/vercel-labs/deepsec --skill deepsec

What comes with it

244 447 bytes besides the instruction

.gitignore

build.mjs

package.json

src/__tests__/agent-config.test.ts

src/__tests__/agent-defaults.test.ts

src/__tests__/credential-brokering.test.ts

src/__tests__/file-sources.test.ts

src/__tests__/formatters.test.ts

src/__tests__/merge-records.test.ts

src/__tests__/metrics.test.ts

src/__tests__/network-policy.test.ts

src/__tests__/output-cap.test.ts

src/__tests__/pr-comment.test.ts

src/__tests__/preflight.test.ts

src/__tests__/resolve-agent-type.test.ts

src/__tests__/resolve-project-id.test.ts

src/__tests__/sandbox-tools.test.ts

src/__tests__/tarball.test.ts

src/agent-config.ts

src/agent-defaults.ts

src/cli.ts

src/commands/enrich.ts

src/commands/export.ts

src/commands/init-project.ts

src/commands/init.ts

src/commands/metrics.ts

src/commands/process.ts

src/commands/report.ts

src/commands/revalidate.ts

src/commands/sandbox-all.ts

src/commands/sandbox-process.ts

src/commands/scan.ts

src/commands/status.ts

src/commands/triage.ts

src/config.ts

src/data-commit.ts

src/file-sources.ts

src/formatters.ts

src/load-config.ts

src/output-cap.ts

The instruction itself

4 sections, as written by the author

deepsec

deepsec is an AI-powered vulnerability scanner. This skill activates

when deepsec ships inside node_modules/ — typically because the user

ran npx deepsec … (which caches the package locally). In the more

common dedicated-git setup the user works inside a clone of

vercel-labs/deepsec and the same docs sit at docs/ from the repo root —

read those instead when this skill fires from outside a node_modules.

When the user asks how to use, configure, or extend deepsec, read the

relevant doc before answering — the docs are the source of truth, not

your training data.

Where the docs are

node_modules/deepsec/dist/docs/ (or <deepsec-clone>/docs/):

getting-started.md — first-scan walkthrough
configuration.md — full deepsec.config.ts reference
plugins.md — plugin slots (matchers, notifiers, ownership, people, executor)
writing-matchers.md — how to grow the matcher set with a coding agent
models.md — model selection, defaults, refusals, future models
vercel-setup.md — getting AI Gateway and Vercel Sandbox keys / tokens
architecture.md — pipeline internals
data-layout.md — data/ schemas (FileRecord, RunMeta, …)
faq.md — cost, model choice, sandbox mode, FP rate

Worked example

node_modules/deepsec/dist/samples/webapp/ (or <deepsec-clone>/samples/webapp/)

is a complete reference setup — deepsec.config.ts with an inline

plugin, two custom matchers under matchers/, an INFO.md for AI

prompt context, and a per-project config.json. When the user asks

"what should my config look like?", read this directory.

How to answer common questions

"How do I run a scan?" → getting-started.md.
"What goes in deepsec.config.ts?" → configuration.md + samples/webapp/deepsec.config.ts.
"How do I add a matcher?" → writing-matchers.md + samples/webapp/matchers/*.ts.
"How do I write a plugin?" → plugins.md + samples/webapp/deepsec.config.ts (inline plugin pattern).
"What does deepsec actually do?" → architecture.md.
"What's in data/<id>/files/foo.json?" → data-layout.md.
"Which model / agent should I use?" → models.md.
"How do I get an AI Gateway / Sandbox token?" → vercel-setup.md.

Read the doc before paraphrasing. The CLI flag set, defaults, and

plugin-contract field names change — quote the doc, don't recall.

Other skills for the same job

different authors, same section of the catalogue

Solidity Security

by wshobson

Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.

3k tokens

Finding Discipline

by hypnguyen1209

Use when about to record, claim, rate the severity of, or report any security finding — before marking anything [CONFIRMED] or writing it into the report

> (1) setting up a new Apollo Server project, (2) writing resolvers or defining GraphQL schemas, (3) implementing authentication or authorization, (4) creating plugins or custom data sources, (5) troubleshooting Apollo Server errors or performance issues.

17k tokens

Neo4j Graphql Skill

by neo4j-contrib

Build and configure a GraphQL API backed by Neo4j using @neo4j/graphql v7 (current) or v5 (LTS). Covers Neo4jGraphQL constructor, getSchema(), assertIndexesAndConstraints(), type definitions with @node, @relationship (IN/OUT/UNDIRECTED), @cypher for custom resolvers, @authorization/@authentication for JWT/JWKS security, auto-generated queries/mutations, OGM programmatic access, subscriptions via CDC, and Apollo Federation. Use when writing typeDefs, securing fields, or wiring Neo4j to Apollo Server. Does NOT handle raw Cypher outside resolvers — use neo4j-cypher-skill. Does NOT cover Spring Data Neo4j entity mapping — use neo4j-spring-data-skill.

Guide users through a structured workflow for co-authoring documentation. Use when user wants to write documentation, proposals, technical specs, decision docs, or similar structured content. This workflow helps users efficiently transfer context, refine content through iteration, and verify the doc works for readers. Trigger when user mentions writing docs, creating proposals, drafting specs, or similar documentation tasks.

Automatically creates user-facing changelogs from git commits by analyzing commit history, categorizing changes, and transforming technical commits into clear, customer-friendly release notes. Turns hours of manual changelog writing into minutes of automated generation.

774 tokens

How to use it

Copy the folder

Take vercel-labs/deepsec from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.

Install what it needs

The instructions reference npx. Without those the skill loads but fails at the first command.