Deepsec
Run deepsec, an AI-powered cyber-security vulnerability scanner. Activates when the user invokes /deepsec, asks to run deepsec, or wants to scan their repo, branch, or uncommitted changes for vulnerabilities.
Install
npx skills add vercel-labs/deepsec --skill deepsecgit clone --depth 1 https://github.com/vercel-labs/deepsec.git /tmp/deepsec
mkdir -p ~/.claude/skills
cp -r /tmp/deepsec/. ~/.claude/skills/deepsecPersonal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.
From the SKILL.md
# /deepsec — scan this repository with deepsec `deepsec` is an AI-powered vulnerability scanner. - Modern AI models are great at security code review. - Most review solutions only run on pull requests. - That means most legacy code was never reviewed, and your code from 6 months ago was reviewed by older models. - Instead deepsec does security review on ALL of your existing code using scaled VM fanout. - Vercel's deepsec is open source, runs in your own infrastructure, and supports strong agent sandboxing. A fast regex scan flags candidate files, then AI agents investigate each candidate in depth and record findings with severity ratings; findings can later be revalidated, triaged, and exported. Everything it adds to a repository lives in a single `.deepsec/` workspace (config, installed package, per-project data). Because processing runs real AI agents, it costs money in proportion to how much code it investigates. Follow this runbook when the user invokes `/deepsec` or asks for a scan. ## 1. Ask for scope first Ask the user which scope to process, using a structured question tool if you have one (AskUserQuestion in Claude Code), otherwise plain text: - **Uncommitted changes** — working tree + untracked files - **Diff to main** — changes vs `origin/main` (use `main` if there is no `origin` remote) - **Entire codebase** — warn that this is the expensive option: AI processing investigates every candidate file and can cost real money on a large repository
Details
- Skill name
deepsec- Repository
- vercel-labs/deepsec
- License
- Apache-2.0
- Repo updated
- 29 September 2026
FAQ
What does the Deepsec skill do?
Run deepsec, an AI-powered cyber-security vulnerability scanner. Activates when the user invokes /deepsec, asks to run deepsec, or wants to scan their repo, branch, or uncommitted changes for vulnerabilities.
How do I install the Deepsec skill?
skills CLI (Claude Code, Cursor, Codex and more): npx skills add vercel-labs/deepsec --skill deepsec. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.
Is Deepsec popular?
It lives in vercel-labs/deepsec, which has 8,294 GitHub stars and 510 forks.
Related skills
Bug Bounty
5.5kawarexone/Agentic-Bug-Hunter
Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via co
Security Reviewer
12kJeffallan/claude-skills
Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.
Positioning Workshop
7.8kdeanpeters/Product-Manager-Skills
Run a positioning workshop that surfaces target customer, unmet need, category, benefits, and differentiation. Use when your product messaging feels fuzzy, generic, or misaligned.
Secure Code Guardian
12kJeffallan/claude-skills
Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities — including custom security implementations such as hashing passwords with bcrypt/argon2, sanitizing SQL queries with parameterized statements, configuring CORS/CSP headers, validating input with Zod, and setting up JWT tokens. Invoke for authentication, authorization, input validation, encryption, OWASP Top 10 prevention, secure session management, and security hardening. For pre-built OAuth/SSO integrations or standalone security audits, consider a more specialized skill.
Tirith
2.8ksheeki03/tirith
Terminal security analysis for shell environments. This skill should be used when checking commands for supply-chain attacks before execution, scanning repositories for hidden content or config poisoning, scoring URLs for homograph attacks, setting up AI tool protection, inspecting Python package artifacts, governing untrusted tasks or Web3 commands, auditing browser extensions, creating provenance receipts, downloading and executing scripts safely, investigating why tirith blocked a command, managing trusted patterns, running security audits, configuring MCP gateway proxies, or working with t
Google Cloud Waf Security
22kgoogle/skills
Generates security-focused guidance for Google Cloud workloads based on the design principles and recommendations in the Google Cloud Well-Architected Framework (WAF). Use this skill to evaluate workloads, identify security requirements, and provide actionable recommendations for IAM, network security, data protection, and operational security.
Browse the most popular Claude skills, all security skills, or write your own with the skills generator.