How do I install the Deepsec Setup CI skill?

Run npx skillmds@latest add deangrant/deepsec-setup-ci in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Deepsec Setup CI safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Deepsec Setup CI?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Deepsec Setup CI free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Deepsec Setup CI?

deangrant (@deangrant) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Deepsec Setup CI by deangrant — Agent Skill

Name: Deepsec Setup CI
Author: deangrant

Deepsec Setup CI

Set up Vercel deepsec for AI-assisted vulnerability scanning: init workspace, config, matchers, and PR/CI review modes. Use when adding deepsec to a repo or wiring scan/process pipelines for first-party code.

deangrant 04a6c78 4 files · 2.2 KB Updated Sep 17, 2026

File contents

deepsec Setup and CI

Use this skill for first-party codebase vuln scanning with deepsec (not npm dependency scanning). Requires Node.js 22+.

1. Initialize

npx deepsec init
cd .deepsec && pnpm install

Check in .deepsec/ config/INFO.md/matchers; gitignore data/ output. Review deepsec.config.ts (projects, plugins, matchers, defaultAgent).

2. Auth / models

Configure AI Gateway / sandbox or BYOK per docs. Expect model cost; start with defaults. Handle refusals/retries.

3. CI / PR

Use PR/direct review modes; prefer net-new finding exit codes. Two-job Actions patterns separate scan vs gate. Do not scan secrets into logs.

4. Matchers

Add custom matchers for stack-specific sinks; set noise tiers. Prefer additive merge of findings. Framework detection via tech.json where available.

5. Quick checklist

Node 22+; .deepsec committed; data ignored.
Config reviewed; agent auth works.
CI gates on net-new issues.
Custom matchers for critical paths.
Complements DAST (ZAP) — source vs running app.

See reference.md and examples.md.

Frequently asked questions