deepsec

Reads through a codebase hunting for security holes, writing its own detection rules as it goes and taking any you have written by hand.

WHEN TO USE

SCOPE

USE FOR

Initialize deepsec on a project, with the setup resuming automatically if it stops partway.
Run a follow-up vulnerability scan once deepsec's first setup scan has already run.
Write a custom matcher by hand for a vulnerability the generated ones miss.
Build a plugin for notifications, code ownership, or a custom executor step.
Link a Vercel project and choose Sandbox, Gateway, or your own model credentials.

This is a saved copy of the skill's SKILL.md instructions. It may differ from the upstream file or the version you install.

In this document (4)

deepsec is an AI-powered vulnerability scanner. The one-shot initializer installs this skill at .deepsec/node_modules/deepsec/SKILL.md. From inside the isolated workspace the same path is node_modules/deepsec/SKILL.md. In a Deepsec source clone, use the repository's docs/ directory instead.

When the user asks how to use, configure, or extend deepsec, read the relevant doc before answering — the docs are the source of truth, not your training data.

Where the docs are

From the target repository, .deepsec/node_modules/deepsec/dist/docs/; from inside .deepsec, node_modules/deepsec/dist/docs/; or from a Deepsec source clone, <deepsec-clone>/docs/:

getting-started.md — one-shot initialization and resume walkthrough
configuration.md — full deepsec.config.ts reference
plugins.md — plugin slots (matchers, notifiers, ownership, people, executor)
writing-matchers.md — generated declarative vs hand-authored matchers
models.md — model selection, defaults, refusals, future models
vercel-setup.md — exact project link, Sandbox scope, Gateway/BYOK/custom routes
architecture.md — pipeline internals
data-layout.md — data/ schemas (FileRecord, RunMeta, …)
faq.md — cost, model choice, sandbox mode, FP rate

How to answer common questions

"How do I install/init deepsec?" → getting-started.md; default to npx deepsec init, not a manual install/scan recipe.
"Setup stopped; how do I resume?" → getting-started.md + data-layout.md; re-run init or deepsec setup.
"How do I run another scan?" → getting-started.md after noting the first scan/process already ran during setup.
"What goes in deepsec.config.ts?" → configuration.md + samples/webapp/deepsec.config.ts.
"Why did setup generate a matcher?" → writing-matchers.md + the project's generated-matchers.ts.
"How do I add a richer matcher?" → writing-matchers.md + samples/webapp/matchers/*.ts.
"How do I write a plugin?" → plugins.md + samples/webapp/deepsec.config.ts (inline plugin pattern).
"What does deepsec actually do?" → architecture.md.
"What's in data/<id>/files/foo.json?" → data-layout.md.
"Which model / agent should I use?" → models.md.
"How do project linking, Sandbox, or my own credentials work?" → vercel-setup.md.

Read the doc before paraphrasing. The CLI flag set, defaults, and plugin-contract field names change — quote the doc, don't recall.

Agent-native initialization

When you are asked to initialize Deepsec from a non-TTY agent session, first inspect the read-only plan:

npx deepsec init --plan --output json

Then run the requested policy, normally:

npx deepsec init --yes --model-profile value --output jsonl

Parse every output line as JSON. On needs_input, show the supplied message and actions to the user rather than inventing remediation. In particular, VERCEL_AUTH_REQUIRED normally asks the user to run npx vercel login; after they do, follow the returned link action from inside .deepsec. Use npx vercel link when the user needs to choose, or the returned parameterized --yes --team <team-slug> --project <project-name> form for a known existing project. Then rerun the same Deepsec command. Exit code 2 means input is needed and exit code 3 means a requested cost/duration boundary stopped the resumable run. Never expose credential values, bypass --yes, or launch an interactive login yourself.

Local tool required

2 FOR YOU · 1 FOR THE AGENT

All items below are required.

01
Run npx deepsec init on your project
Run npx deepsec init (preview first with --plan --output json) to set deepsec up on the project; if it stops partway, rerunning the same command resumes it.
```
npx deepsec init
```
02
Log in to Vercel when prompted
If the init flow reports VERCEL_AUTH_REQUIRED, log in with npx vercel login yourself, then continue from the link action deepsec returns inside .deepsec.
```
npx vercel login
```
03
Link or choose a Vercel project
Run npx vercel link to pick a project interactively, or pass --yes --team <team-slug> --project <project-name> to target a known one, then rerun the same deepsec command.
```
npx vercel link
```

Listed as free: Connected services may require an account or charge fees.
Installation: One command — usually under 2 minutes.

Not standalone. This skill ships with vercel-labs/deepsec and only works together with that tool — install the tool first, then add this skill.

Run this outside your AI tool, using Node.js 22.20.0 or newer. Skills CLI 1.7.2 skips skill selection; prompts cancel installation without an interactive terminal. If choosing Project when asked about installation scope, open your project's folder before running this.

Install checklist

Check selected tools if a picker appears; Claude Code may be unchecked under Additional agents. ↑/↓ moves, Space toggles selections, Enter confirms.
Without a tool picker, check Installing to: for your intended tool. Stop if it names a different tool.
If asked, choose Symlink (Recommended) for shared files or Copy to all agents for separate copies; review the summary before confirming installation.
Install the find-skills skill? defaults to Yes, adding another skill for all projects. Choose No if you don't want that extra installation.

Skills CLI 1.7.2 sends install data to skills.sh by default, including the source, skill names, target tools and file details; GitHub sources are reported only when GitHub confirms the repository is public, while other remote sources can also be reported. Confirmed-public GitHub sources also trigger a security-audit request. Before installing, set the environment variable DO_NOT_TRACK=1 or DISABLE_TELEMETRY=1 to disable both.

npx skills add vercel-labs/deepsec --skill "deepsec" --full-depth

After installing for Claude Code, open it in the installation project if you chose Project; Global makes the skill available across projects on this computer. Once Claude Code loads the skill, its description helps Claude decide when to use it.

If installation created a top-level skills folder that did not exist when your Claude Code session started, run /reload-skills in that session. Run it again after later changes in that folder.

What's inside

Files included with this skill.

View on GitHub