Agent skill · security · aradotso
deepsec-vulnerability-scanner
AI agent skill for using deepsec, the agent-powered security vulnerability scanner for large codebases
Why this skill is useful
Provides specific commands and workflows for using the deepsec vulnerability scanner that the AI wouldn't reliably generate on its own.
What it needs
Requires pnpm installed locally. Requires anthropic, openai, vercel account access. About 6k tokens when loaded. Last updated 2026-07-09. 70 stars on the source repository.
What this skill does
deepsec Vulnerability Scanner Skill by ara.so — Daily 2026 Skills collection. deepsec is an agent-powered vulnerability scanner that uses coding agents (Claude, Codex) at maximum thinking levels to surface hard-to-find security issues in large codebases. It uses regex matchers to find candidate sites, then AI to deeply investigate each one, producing actionable findings with severity ratings. Installation Navigate to the root of the repo you want to scan: After init, bootstrap the installation by prompting your coding agent: Read .deepsec/nodemodules/deepsec/SKILL.md to understand the tool. Then read .deepsec/data/<id>/SETUP.md and follow it: skim this repo's README, any AGENTS.md/CLAUDE.md, and a handful of representative code files, then replace each section of .deepsec/data/<id>/INFO.md. Keep it SHORT — target 50–100 lines total. AI Provider Setup Vercel AI Gateway (recommended for large scans) One key covers both Claude and Codex. Get a key from the Vercel dashboard. Direct provider keys (bypasses gateway) Explicit values always win over AIGATEWAYAPIKEY expansion. Core Workflow Run these commands from inside .deepsec/: Full Command Reference Command What it does --- --- scan Regex matcher pass — fast, no AI cost process AI deep-investigation of candidates triage Lightweight P0/P1/P2 classification (cheaper model) revalidate Re-check findings; checks git history for fixes enrich Add git committer info + ownership data report Markdown + JSON summary for one project export Per-finding JSON or directory of markdown files metrics Cross-project counts: severities, vulns by type, TPs status Snapshot of the project mirror sandbox <cmd> Run any command on Vercel Sandbox microVMs Configuration Create deepsec.config.ts in your .deepsec/ directory: See docs/configuration.md for the full deepsec.config.ts reference. Writing Custom Matchers Matchers are regex patterns that identify candidate code sites for AI investigation. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/deepsec-vulnerability-scanner