Skip to content
Get packs

deepsec Vulnerability Scanner

Scans your repo or recent changes for security vulnerabilities using AI agents

Source Download skill
Repository
vercel-labs/deepsec
Stars
8,307
Licence
Apache-2.0
Files
12 files

What it does

When you ask for a security scan, the agent first asks whether to scan uncommitted changes, changes against main, or the entire codebase. It then sets up the deepsec tool inside a .deepsec/ folder in your repo, runs a fast regex pass to flag candidate files, and has AI agents investigate each candidate and record findings with severity ratings. It can then summarize results and offer to revalidate, triage, or export them as markdown.

Great for

  • Developers who want a security review of existing code, not just new pull requests
  • Teams wanting to gate changes in CI on net-new security findings
  • Anyone who wants an AI-assisted audit of a branch before merging

Skip it if

  • Projects where a full-repo AI scan's cost is unacceptable, since whole-codebase processing can cost real money in proportion to the code investigated
  • Non-developers without a way to review findings, as results are technical and may include false positives
  • Repos where you cannot have a third-party tool write a .deepsec/ folder and install packages

Try asking

  • “/deepsec scan my uncommitted changes for vulnerabilities”
  • “Run deepsec on the diff against main and tell me about any new findings”
  • “Scan the entire codebase with deepsec and export the findings as markdown”
  • “Revalidate the existing deepsec findings in this repo”
Step-by-step guide: how to use deepsec Vulnerability ScannerInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 12 original files, the Apache-2.0 licence and an attribution note.

    deepsec.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip deepsec.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip deepsec.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Start with uncommitted changes or diff to main to keep AI processing costs low before running a full-codebase scan
  • Review the cost warning and scope choice carefully before confirming an entire-codebase run
  • Read the installed docs in .deepsec/node_modules/deepsec/dist/docs/ before changing flags, since defaults change between releases

What's inside

  • biome.json
  • CLAUDE.md
  • CODE_OF_CONDUCT.md
  • CONTRIBUTING.md
  • knip.json
  • package.json
  • pnpm-workspace.yaml
  • README.md
  • SECURITY.md
  • SKILL.md
  • tsconfig.base.json
  • vitest.workspace.ts

Redistributed unmodified from vercel-labs/deepsec under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.