oma-deepsec

Featured

Set up and run Deepsec vulnerability scans, triage, and CI gates. Use for Deepsec work or an explicitly requested agent-powered vulnerability scan.

AI & Automation 1,323 stars 151 forks Updated yesterday MIT

Install

View on GitHub

Quality Score: 92/100

Stars 20%

100

Recency 20%

100

Frontmatter 20%

Documentation 15%

100

Issue Health 10%

License 10%

100

Description 5%

100

Skill Content

# Deepsec: Agent-Powered Vulnerability Scanner Driver ## Scheduling ### Goal Operate Vercel's `deepsec` security scanner inside a target repository safely and cost-consciously: bootstrap the `.deepsec/` workspace, write a tight `INFO.md`, run the right scan/process/triage/revalidate/export sequence, gate PRs in CI via `process --diff`, and grow project-specific matchers, surfacing real, revalidated findings without runaway spend. ### Intent signature - User mentions `deepsec`, "deep security scan", `bunx deepsec`, `pnpm deepsec`, `npx deepsec`. - User asks an agent to scan a repository for vulnerabilities, security issues, or CVEs and the project has (or should have) a `.deepsec/` directory. - User asks how to add a deepsec PR / CI security gate, or about `process --diff`, `--diff-staged`, `--diff-working`, `--files-from`, `--comment-out`. - User mentions deepsec artefacts: `INFO.md`, `SETUP.md`, `data/<id>/files/`, `FileRecord`, `RunMeta`, `revalidation`, `triage`, custom matchers, `MatcherPlugin`, `noiseTier`, `priorityPaths`. - User asks about deepsec configuration: `deepsec.config.ts`, `defaultAgent`, `AI_GATEWAY_API_KEY`, `VERCEL_OIDC_TOKEN`, AI Gateway, Vercel Sandbox, `--agent codex`, `--agent claude`. - User asks how to lower deepsec cost, cut false-positive rate, or interpret severity / triage / revalidation verdicts. ### When to use - First-time deepsec install in a repo (`init`, `INFO.md` write, first calibration scan). - Running a full or scoped scan and proce...

Details

Author: first-fluke
Repository: first-fluke/oh-my-agent
Created: 7 months ago
Last Updated: yesterday
Language: TypeScript
License: MIT

Integrates with

Vercel · Cloud

Bundled in these plugins

oh-my-agent

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Listed

security

Deep security audit of the agent setup. Deterministic rules (prompt injection, credential access, exfiltration, obfuscation, taint tracking, MCP analysis, YARA, CVE lookup) plus LLM semantic review. Use when the user asks about security or needs a pre-deployment audit.

30 Updated 1 weeks ago

redhat-community-ai-tools

Data & Documents Listed

deep-security-audit

Deep, multi-agent security audit of a codebase — WordPress plugin, Laravel, Next.js, Node/Express, Django/Rails, or any app. Detects the framework, maps the REAL attack surface (routes, handlers, auth, sinks), then fans out scoped finder agents that READ and understand the code (not just grep), adversarially verifies every finding (proves the guard is genuinely absent + traces reachability), scores honest CVSS 3.1, dedupes, and produces a ranked report. Use whenever the user asks to find security issues / vulnerabilities, run a security audit or pentest, "is this secure", "scan this plugin/app/repo", or review auth / SSRF / IDOR / injection / secrets. READ-ONLY by default — never edits, commits, or exploits live systems.

3 Updated 1 months ago

ravindrakele

AI & Automation Listed

secscan

In-session, token-efficient LLM security scan of a repo (SAST triage). A lightweight, native Claude Code pipeline — survey → threat-model → deep-dive → adversarial-verify → report — using Read/Grep/Glob (and optional subagents), no external tooling. Use when asked to "security scan", "find vulnerabilities", "SAST", "audit this code for security", or "secscan".

50 Updated 1 weeks ago

atgreen