Guide · Agent skill
How to use the deepsec vulnerability scanner agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
deepsec is an AI-powered security scanner from Vercel Labs, and this agent skill lets your coding agent run it for you. Once installed, you can ask the agent to scan your repository, a branch, or your uncommitted changes, and it will handle setup and the scan. This guide covers what the skill does, how to install it, how to trigger it, and what it needs before you start.
deepsec Vulnerability Scannervercel-labs/deepsec · Apache-2.0 Download the skill Quick start
- 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or your project's .claude/skills/ folder. In the Claude apps, you can upload it under Settings → Capabilities → Skills instead.
- 2Check prerequisites. Make sure Node.js with npx is installed and that you have a Vercel account to log in with.
- 3Ask the agent to scan. Type /deepsec or a request such as 'scan my uncommitted changes' in your repository.
- 4Choose a scope. When asked, pick uncommitted changes, diff to main, or the entire codebase. The entire codebase option is the most expensive.
- 5Log in to Vercel. If setup asks for it, run npx vercel login yourself, then let the agent continue the setup.
- 6Review the findings. Read the summary, then ask the agent to revalidate, triage, or export the findings as markdown.
What the deepsec skill makes the agent do
An agent skill is a folder with a SKILL.md file that gives your AI agent a set of instructions for a specific task. The deepsec skill tells the agent how to run deepsec, which is an AI-powered vulnerability scanner that runs in your own infrastructure.
When you ask for a scan, the agent first asks which scope to process: uncommitted changes, changes against main, or the entire codebase. It then sets up deepsec inside a .deepsec/ folder in your repo and runs a fast regex pass to flag candidate files. AI agents then investigate each candidate and record findings with severity ratings. Afterwards the agent can summarize results and offer to revalidate, triage, or export them as markdown.
Install the deepsec skill
Download the ZIP from this page and unzip it. For a personal install that works in every project, unzip it into ~/.claude/skills/. For a single project, unzip it into that project's .claude/skills/ folder.
In the Claude apps you can instead upload the skill under Settings → Capabilities → Skills.
- Personal: ~/.claude/skills/deepsec
- Project: .claude/skills/deepsec inside your repository
Trigger the skill with natural requests
The skill activates when you type /deepsec, ask to run deepsec, or ask to scan your repo, branch, or uncommitted changes for vulnerabilities. You do not need to remember exact commands; a plain request is enough.
- /deepsec
- Run deepsec on this repo
- Scan my uncommitted changes for security issues
- Do a security review of this branch before I merge
Understand what the scan needs
You need Node.js with npx. During setup you must log in with Vercel, and linking a Vercel project is optional. deepsec also needs AI model access or credentials as configured by deepsec itself; the provided files do not specify the details, so check the deepsec docs for your model setup.
The skill runs scripts and uses the network. Setup writes files and installs packages into the .deepsec/ folder.
- Node.js with npx
- Vercel account login via npx vercel login (required during setup)
- Optional: Vercel project link via npx vercel link
- AI model access or credentials, as configured by deepsec
npx vercel loginReview the safety points before running
The skill runs scripts and makes network calls, and it adds a .deepsec/ workspace to your repository. Review that folder and the commands before you approve them. The agent is instructed not to expose credential values or start an interactive login on your behalf; you run npx vercel login yourself.
Processing runs real AI agents, so cost grows with the amount of code investigated. A full-codebase scan on a large repository can cost real money.
- Scans run in your own infrastructure, and deepsec supports strong agent sandboxing according to its source.
- Scope the scan to changes when you do not need a full review.
- Do not use this skill if you cannot have a third-party tool write a .deepsec/ folder and install packages.
Read and act on the results
In direct mode on a diff, the exit code tells you whether the change added anything new: 0 means no net-new findings, 1 means at least one net-new finding, and other codes mean a runtime error. Findings already present on touched files are excluded from this gate.
From inside .deepsec/, you can view a report, revalidate findings, or export them as markdown. Results are technical and may include false positives, so have a developer review each one.
- Exit 0: no net-new findings
- Exit 1: at least one net-new finding (not an error)
- Other exit codes: runtime error
cd .deepsec && npx deepsec export --format md-dir --out ./findingsWhat people use it for
- Reviewing an existing codebase that has never had a security review, not just new pull requests.
- Auditing a feature branch with an AI-assisted scan before merging.
- Gating CI on net-new security findings introduced by a change.
- Checking uncommitted work before you commit it.
Frequently asked questions
Is the deepsec skill free?
The deepsec project is open source under the Apache-2.0 licence. Running it is not free in the sense of no cost, because processing runs real AI agents and costs money in proportion to the code investigated.
What do I need to install the deepsec agent skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it in the Claude apps under Settings → Capabilities → Skills. You also need Node.js with npx and a Vercel account for login during setup.
Why does deepsec ask me to run npx vercel login?
Setup requires a Vercel account login. The skill asks you to run npx vercel login yourself, and the agent will not launch an interactive login on your behalf. Linking a project with npx vercel link is optional.
Can I scan only my changes instead of the whole repo?
Yes. The agent asks you to choose uncommitted changes or diff to main before doing anything else. Scanning the entire codebase is the expensive option.
Will deepsec find every vulnerability?
No guarantee is given in the source. Results are technical and may include false positives, so a developer should review each finding before acting on it.
Does deepsec work with Claude Code and other agents?
The skill installation paths given here are for Claude (~/.claude/skills/, .claude/skills/, and the Claude apps). The source does not say which other agents are supported.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you want an AI-assisted security review of existing code or a branch before merging, and you are comfortable with a .deepsec/ folder, package installs, network calls and model costs. Pick something else if you need a cheap or fully offline check, or if you cannot have a tool write files and install packages in your repository.
Download the skill