--- title: "deepsec by vercel-labs · skilld" canonical_url: "https://skilld.dev/gh/vercel-labs/deepsec" meta: description: "Use deepsec (an AI-powered vulnerability scanner) — one-shot initialization, resumable setup, project/model credentials, scans, generated or hand-authored matchers, and… From vercel-labs/deepsec." "og:description": "Use deepsec (an AI-powered vulnerability scanner) — one-shot initialization, resumable setup, project/model credentials, scans, generated or hand-authored matchers, and… From vercel-labs/deepsec." "og:title": "deepsec by vercel-labs" "twitter:description": "Use deepsec (an AI-powered vulnerability scanner) — one-shot initialization, resumable setup, project/model credentials, scans, generated or hand-authored matchers, and… From vercel-labs/deepsec." "twitter:title": "deepsec by vercel-labs" --- ` [All skills](https://skilld.dev/skills) [![vercel-labs avatar](https://skilld.dev/_img/avatar?url=https%3A%2F%2Fgithub.com%2Fvercel-labs.png%3Fsize%3D96)](https://skilld.dev/gh/vercel-labs) # **/deepsec** [@9722127](https://github.com/vercel-labs/deepsec/commit/9722127bff6b36cc5ff4fe2e941dbf40822fe044 "Your agent reads SKILL.md at commit 9722127") by [Vercel Labs](https://skilld.dev/gh/vercel-labs)· [vercel-labs](https://skilld.dev/gh/vercel-labs)/ [deepsec](https://skilld.dev/gh/vercel-labs/deepsec)·8.1k stars 489 Use deepsec (an AI-powered vulnerability scanner) — one-shot initialization, resumable setup, project/model credentials, scans, generated or hand-authored matchers, and plugins. Activates when the user asks how to initialize, scan, configure, resume, or extend deepsec. - 110 files - 695.3 KB - Updated 2 months ago - [GitHub](https://github.com/vercel-labs/deepsec/blob/main/packages/deepsec/SKILL.md "View SKILL.md on GitHub") - [2 warnings](#third-party-checks "Third-party checks: 2 warnings · 3 checks · Risk SAFE") ## SKILL.md 3.8 KB **≈70** tokens always: the name and description. **≈890** when used: this file. **≈630** more on demand in 3 files. ## deepsec `deepsec` is an AI-powered vulnerability scanner. The one-shot initializer installs this skill at `.deepsec/node_modules/deepsec/SKILL.md`. From inside the isolated workspace the same path is `node_modules/deepsec/SKILL.md`. In a Deepsec source clone, use the repository's `docs/` directory instead. When the user asks how to use, configure, or extend deepsec, read the relevant doc before answering — the docs are the source of truth, not your training data. ### Where the docs are From the target repository, `.deepsec/node_modules/deepsec/dist/docs/`; from inside `.deepsec`, `node_modules/deepsec/dist/docs/`; or from a Deepsec source clone, `/docs/`: - `getting-started.md` — one-shot initialization and resume walkthrough - `configuration.md` — full `deepsec.config.ts` reference - `plugins.md` — plugin slots (matchers, notifiers, ownership, people, executor) - `writing-matchers.md` — generated declarative vs hand-authored matchers - `models.md` — model selection, defaults, refusals, future models - `vercel-setup.md` — exact project link, Sandbox scope, Gateway/BYOK/custom routes - `architecture.md` — pipeline internals - `data-layout.md` — `data/` schemas (FileRecord, RunMeta, …) - `faq.md` — cost, model choice, sandbox mode, FP rate ### How to answer common questions - **"How do I install/init deepsec?"** → `getting-started.md`; default to `npx deepsec init`, not a manual install/scan recipe. - **"Setup stopped; how do I resume?"** → `getting-started.md` + `data-layout.md`; re-run init or `deepsec setup`. - **"How do I run another scan?"** → `getting-started.md` after noting the first scan/process already ran during setup. - **"What goes in `deepsec.config.ts`?"** → `configuration.md` + `samples/webapp/deepsec.config.ts`. - **"Why did setup generate a matcher?"** → `writing-matchers.md` + the project's `generated-matchers.ts`. - **"How do I add a richer matcher?"** → `writing-matchers.md` + `samples/webapp/matchers/*.ts`. - **"How do I write a plugin?"** → `plugins.md` + `samples/webapp/deepsec.config.ts` (inline plugin pattern). - **"What does deepsec actually do?"** → `architecture.md`. - **"What's in `data//files/foo.json`?"** → `data-layout.md`. - **"Which model / agent should I use?"** → `models.md`. - **"How do project linking, Sandbox, or my own credentials work?"** → `vercel-setup.md`. Read the doc before paraphrasing. The CLI flag set, defaults, and plugin-contract field names change — quote the doc, don't recall. ### Agent-native initialization When you are asked to initialize Deepsec from a non-TTY agent session, first inspect the read-only plan: ``` npx deepsec init --plan --output json ``` Then run the requested policy, normally: ``` npx deepsec init --yes --model-profile value --output jsonl ``` Parse every output line as JSON. On `needs_input`, show the supplied message and actions to the user rather than inventing remediation. In particular, `VERCEL_AUTH_REQUIRED` normally asks the user to run `npx vercel login`; after they do, follow the returned link action from inside `.deepsec`. Use `npx vercel link` when the user needs to choose, or the returned parameterized `--yes --team --project ` form for a known existing project. Then rerun the same Deepsec command. Exit code 2 means input is needed and exit code 3 means a requested cost/duration boundary stopped the resumable run. Never expose credential values, bypass `--yes`, or launch an interactive login yourself. Source: [SKILL.md on GitHub](https://github.com/vercel-labs/deepsec/blob/main/packages/deepsec/SKILL.md) ## Third-party checks
2 warnings1d3 checks · Risk SAFE - Gen Agent Trust Hub1d This skill is a security scanner that uses AI agents to perform in-depth vulnerability research. It possesses powerful capabilities, including the ability to execute shell commands and access the local filesystem to facilitate scanning. While these features are central to its function and are supported by robust documentation and sandboxing options, they represent a significant security surface that should be reviewed before use, especially when analyzing untrusted codebases. - Socket1d 14 alerts: gptSecurity, gptAnomaly - Snyk1d Risk: unknown · No issues
## Provenance [Signed by skilld at 9722127.](https://github.com/vercel-labs/deepsec/commit/9722127bff6b36cc5ff4fe2e941dbf40822fe044 "9722127bff6b36cc5ff4fe2e941dbf40822fe044") This ties the file your Agent reads to that commit on GitHub. It does not review the instructions. Last checked against GitHub 2 days ago. Activeupdated 2 months ago ## README badge ![README badge for vercel-labs/deepsec](https://skilld.dev/b/vercel-labs/deepsec?theme=light&label=0) ## Related skills - - - - - -