Skip to content
Get packs

deepsec Vulnerability Scanner Guide

Guides an agent through installing, configuring, running and extending the deepsec AI vulnerability scanner

Source Download skill
Repository
vercel-labs/deepsec
Stars
8,307
Licence
Apache-2.0
Files
15 files

What it does

deepsec is an AI-powered tool that scans a code repository for security vulnerabilities. This skill gives the agent the deepsec documentation map and rules: it tells the agent to read the relevant official doc before answering, to set up deepsec with its one-shot init command, and to resume setup or add custom matchers and plugins when asked. It also includes a non-interactive setup procedure for agent sessions that handles login prompts and cost limits by handing decisions back to the user.

Great for

  • Developers who want to run deepsec on their own project and need help with setup
  • Security-minded engineers configuring deepsec.config.ts, model choice or custom matchers
  • Teams wanting an agent to resume a stalled deepsec initialization

Skip it if

  • People looking for a standalone vulnerability report without installing a scanner: this skill only guides deepsec, it does not itself audit code
  • Scanning repositories you do not own or have permission to test, since scans send code to AI model providers
  • Use where credentials must stay out of agent context: the setup flow involves login and API key configuration that should be handled by the user

Try asking

  • “Set up deepsec in this repository and resume it if the setup stopped”
  • “Write a deepsec.config.ts that uses a custom model route for my team”
  • “Help me write a custom matcher to flag unsafe SQL string concatenation with deepsec”
  • “Explain what deepsec does with my code and what the data/ folder contains”
Step-by-step guide: how to use deepsec Vulnerability Scanner GuideInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 15 original files, the Apache-2.0 licence and an attribution note.

    deepsec.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip deepsec.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip deepsec.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Let the agent read the official docs in dist/docs before answering; the skill asks it to quote them rather than rely on memory
  • Review cost and duration limits before running scans on large repositories, since AI model calls are billed
  • Keep API keys in environment variables or your own shell, not in chat, and follow the skill's rule to show the user login steps instead of running them

What's inside

  • build.mjs
  • package.json
  • SKILL.md
  • src/__tests__/agent-config.test.ts
  • src/__tests__/agent-defaults.test.ts
  • src/__tests__/credential-brokering.test.ts
  • src/__tests__/ensure-connected-workspace.test.ts
  • src/__tests__/env-file.test.ts
  • src/__tests__/file-sources.test.ts
  • src/__tests__/formatters.test.ts
  • src/__tests__/merge-records.test.ts
  • src/__tests__/metrics.test.ts
  • src/__tests__/model-picker.test.ts
  • src/__tests__/model-route.test.ts
  • src/__tests__/network-policy.test.ts

Redistributed unmodified from vercel-labs/deepsec under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.