deepsec
starsforks
How to install deepsec?
vercel-labs/dev3000/deepsec
$npx -y skills add vercel-labs/dev3000 --skill deepsecRun DeepSec against a Vercel project checkout from dev3000. Use for one-click DeepSec setup, project context bootstrapping, bounded first-pass processing, and report generation.
SKILL.md
| 1 | # DeepSec Dev3000 Runbook |
| 2 | |
| 3 | Use this skill to turn the manual DeepSec workflow into a repeatable dev3000 run against the current Vercel project checkout. |
| 4 | |
| 5 | ## Operating Policy |
| 6 | |
| 7 | - Work from the real project checkout at `/workspace/repo`. |
| 8 | - Do not write AI credentials into `.deepsec/.env.local` or any tracked file. The dev3000 runtime passes AI Gateway credentials through the process environment. |
| 9 | - Default dev3000 runs are a bounded first pass. Do not run an unbounded `process` or `revalidate` command unless the user explicitly asks for a full DeepSec scan in run-specific instructions. |
| 10 | - Keep generated scan state in the locations DeepSec already gitignores. Commit only the durable setup/context files and human-readable findings report. |
| 11 | - Treat DeepSec as a coding agent with shell access. Do not run it on untrusted source inputs. |
| 12 | |
| 13 | ## Default Flow |
| 14 | |
| 15 | 1. Inspect the project shape: |
| 16 | - Read `README.md` if present. |
| 17 | - Read `AGENTS.md` or `CLAUDE.md` if present. |
| 18 | - Skim representative files for auth, middleware, request handlers, data access, billing, webhooks, and security-sensitive boundaries. |
| 19 | 2. Initialize DeepSec if needed: |
| 20 | - If `.deepsec/` is absent, run `npx --yes deepsec@latest init`. |
| 21 | - If `.deepsec/` already exists, do not force overwrite it. |
| 22 | 3. Install DeepSec workspace dependencies: |
| 23 | - Run `corepack pnpm install` from `.deepsec/`. |
| 24 | - Ensure the Claude Agent SDK native binary that DeepSec actually uses is available. Do not run a Claude Code postinstall; DeepSec uses `@anthropic-ai/claude-agent-sdk`. |
| 25 | - If `corepack pnpm` is unavailable, run `pnpm install` only after confirming `pnpm` exists. |
| 26 | 4. Fill the generated project context: |
| 27 | - Read `.deepsec/node_modules/deepsec/SKILL.md`. |
| 28 | - Read `.deepsec/data/<id>/SETUP.md`. |
| 29 | - Replace `.deepsec/data/<id>/INFO.md` with concise project-specific context. |
| 30 | - Keep `INFO.md` to roughly 50-100 lines. |
| 31 | - Use 3-5 examples per section. Name local primitives such as auth helpers, middleware, database clients, webhook handlers, and privileged APIs. |
| 32 | - Do not include line numbers, generic CWE lists, or broad framework summaries. |
| 33 | 5. Run the scan: |
| 34 | - Run `corepack pnpm deepsec scan` from `.deepsec/`. |
| 35 | 6. Run bounded AI processing: |
| 36 | - Default command: `corepack pnpm deepsec process --limit 25 --concurrency 2 --batch-size 3`. |
| 37 | - If the candidate set is below the limit, state that all discovered candidates were processed. |
| 38 | - If the user explicitly requested a full run, use the requested limit/concurrency or omit `--limit`. |
| 39 | - If the process command fails, stop and report the failure. Do not generate a manual fallback report from regex candidates. |
| 40 | 7. Generate the findings report: |
| 41 | - Run `corepack pnpm deepsec export --format md-dir --out ./findings`. |
| 42 | - If there are no findings, create `.deepsec/findings/README.md` summarizing that this bounded pass found no findings and include the exact commands that were run. |
| 43 | 8. Summarize the run: |
| 44 | - Include commands run, project id, limit/concurrency, and whether the report contains findings. |
| 45 | - Do not include a "Next Steps - Full Scan" section by default. |
| 46 | - Only include a follow-up scan section if DeepSec reports unprocessed candidates or the user explicitly asked about deeper coverage. Label it "Optional Deeper Follow-Up" and explain exactly how it differs from the completed run. |
| 47 | |
| 48 | ## Validation |
| 49 | |
| 50 | - Prefer DeepSec's own command output, `corepack pnpm deepsec status`, and generated finding files as validation. |
| 51 | - Do not start a dev server or browser unless the user explicitly asks for visual/runtime verification. |
| 52 | - Before finishing, check `git diff --stat` and make sure no secrets, `node_modules`, `.env.local`, or raw scan state are staged by accident. |
People who liked this also viewed
6 picksType
- azure-diagnosticsDebug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe triage. WHEN: debug production issues, troubleshoot app service, app service high CPU, app service deploySkillsJul 2026
- systematic-debuggingUse when encountering any bug, test failure, or unexpected behavior, before proposing fixesSkillsJul 2026
- safe-debugRigor Debug / Rigor Audit skill for deep learning research work. Use when the user pastes a traceback, terminal error, CUDA OOM, checkpoint load failure, shape mismatch, NaN loss symptom, or training SkillsMay 2026
- explore-runRigor Improve / Rigor Explore run leaf skill for bounded exploratory evidence in deep learning research repositories. Use when the researcher explicitly authorizes exploratory runs such as small-subseSkillsMay 2026
- minimal-run-and-auditRigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation SkillsMay 2026
- insforge-debugUse when diagnosing problems in an InsForge project — reactive failures (SDK error object, HTTP 4xx/5xx, gateway timeout 502/503/504, edge function failure or timeout, login/OAuth/auth errors, RLS denSkillsJul 2026
