Guide · Agent skill
How to use the deepsec Vulnerability Scanner Guide agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The deepsec-docs skill is a guide that teaches an AI agent how to work with deepsec, an AI-powered vulnerability scanner that checks a code repository for security issues. It is for developers and security-minded engineers who want help installing, configuring, resuming or extending deepsec. After following this page you will know how to install the skill, ask for help with natural requests, and understand what the agent will and will not do on your behalf.
deepsec Vulnerability Scanner Guidevercel-labs/deepsec · Apache-2.0 Download the skill Quick start
- 1Check Node.js and npx. Confirm Node.js is installed, since deepsec builds for node22, and that npx can reach the deepsec npm package.
- 2Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or your project's .claude/skills/ folder.
- 3Ask for initialization. Tell the agent you want to initialize deepsec in your repository and name deepsec in the request.
- 4Review the plan. The agent runs the read-only plan command first so you can see what setup will do.
- 5Complete any login or key step yourself. If the agent reports that login is required, run the login command yourself and then tell the agent to continue.
- 6Resume if setup stops. Ask the agent to resume setup, which re-runs the same deepsec command from the same point.
What an agent skill is and what this one does
An agent skill is a folder containing a SKILL.md file and supporting files. When your agent judges that a skill is relevant to your request, it reads the skill's instructions and follows them. This skill is named deepsec-docs.
This skill does not audit code itself. It gives the agent the deepsec documentation map and rules: read the relevant official doc before answering, set up deepsec with its one-shot init command, and resume setup or add custom matchers and plugins when asked. It also includes a non-interactive setup procedure for agent sessions that hands login prompts and cost decisions back to you.
Install the deepsec-docs skill
Download the skill ZIP from this page and unzip it. Then place the resulting folder in one of these locations: ~/.claude/skills/ for your personal use across projects, or .claude/skills/ inside a specific project to share it with that project.
You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
- Personal: unzip into ~/.claude/skills/
- Per project: unzip into the project's .claude/skills/ folder
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
Trigger the skill with natural requests
You do not need a special command. The skill activates when you ask how to initialize, scan, configure, resume or extend deepsec. Ask in plain language and name deepsec so the agent knows which tool you mean.
The agent is instructed to read the relevant doc before answering, so expect it to check the docs rather than rely on memory.
- How do I initialize deepsec in this repository?
- My deepsec setup stopped halfway. How do I resume it?
- What goes in deepsec.config.ts for my project?
- Why did setup generate a matcher, and how do I add a richer one?
- How do I write a deepsec plugin?
- Which model should deepsec use, and how do I set my own API key?
What the agent does during setup
For a non-interactive agent session, the skill tells the agent to first inspect a read-only plan, then run the requested setup policy. The agent parses the JSON output and, when input is needed, shows you the message and actions instead of guessing.
If the setup needs a Vercel login, the agent asks you to run the login command yourself. The agent is told never to expose credential values, bypass the --yes confirmation, or start an interactive login on your behalf.
npx deepsec init --plan --output jsonSafety notes: scripts and network access
This skill runs scripts and uses the network. Scans send code to AI model providers, so only scan repositories you own or have permission to test. Setup also involves login and API key configuration, so if credentials must stay out of agent context, handle that step yourself.
The skill's files include build.mjs, package.json and a set of tests under src/__tests__/. Review them if you want to check what the skill contains before you install it.
- Only scan code you own or are authorised to test, because code is sent to model providers.
- Do the login and API key steps yourself if your credentials must not enter agent context.
- Watch cost and duration limits: the source says a resumable run can stop at a requested boundary.
Tips for getting better results
Name your goal precisely, such as initialize, resume, configure or add a matcher. The agent will then open the matching doc from the deepsec documentation map.
If setup stops, keep the output. The agent can use it to resume from the same point instead of starting again.
- Ask for the specific doc topic, for example configuration or models.
- Share the exact error or JSON output line when something fails.
- Ask the agent to quote the doc rather than paraphrase it, since CLI flags and defaults can change.
What people use it for
- Setting up deepsec on your own project with the one-shot init command.
- Resuming a stalled deepsec initialization after a login or cost pause.
- Reviewing or editing deepsec.config.ts for model choice and project settings.
- Writing a hand-authored matcher after setup generated a simpler one.
- Writing a plugin for matchers, notifiers, ownership or people lookups.
Frequently asked questions
How do I install the deepsec skill?
Download the skill ZIP from this page and unzip it into ~/.claude/skills/ for personal use or a project's .claude/skills/ folder for one project. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
What do I need to run deepsec?
You need Node.js (the build targets node22), npx access to the deepsec npm package, and either a Vercel account with login for the default Vercel-linked setup or your own model API key for Gateway, BYOK or custom routes.
Is deepsec free to use?
This page does not state pricing or licence terms beyond the package licence, which is Apache-2.0. Check the deepsec documentation's cost and FAQ pages for details on model costs, since scans call AI model providers.
Does this skill scan my code for vulnerabilities by itself?
No. The skill only guides you through deepsec, which is the scanner. You still need to install and run deepsec on a repository you have permission to test.
What should I do if my deepsec setup stopped or needs login?
Ask your agent to resume setup. If it reports that Vercel login is needed, run the login command yourself, then let the agent continue from the returned link or rerun the same command.
How does deepsec compare with other vulnerability scanners?
This source does not include a comparison with other scanners, so this page cannot make one. The skill's own scope is limited to guiding deepsec's setup, configuration and extension.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you want an agent to walk you through installing, configuring, resuming or extending deepsec on a repository you are allowed to scan. Pick something else if you only want a finished vulnerability report, or if you cannot send code to AI model providers or share login steps with an agent.
Download the skill