[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-vercel-labs-deepsec-docs":3,"mdc--qj4jq9-key":36,"related-repo-vercel-labs-deepsec-docs":681,"related-org-vercel-labs-deepsec-docs":701},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":25,"repoUrl":26,"updatedAt":27,"license":28,"forks":29,"topics":30,"repo":31,"sourceUrl":34,"mdContent":35},"deepsec-docs","scan code for vulnerabilities with deepsec","Use deepsec (an AI-powered vulnerability scanner) — one-shot initialization, resumable setup, project\u002Fmodel credentials, scans, generated or hand-authored matchers, and plugins. Activates when the user asks how to initialize, scan, configure, resume, or extend deepsec.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"vercel-labs","Vercel Labs","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fvercel-labs.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Automation","automation",{"name":20,"slug":21,"type":15},"Code Analysis","code-analysis",{"name":23,"slug":24,"type":15},"Debugging","debugging",5186,"https:\u002F\u002Fgithub.com\u002Fvercel-labs\u002Fdeepsec","2026-08-11T04:06:27.495823",null,309,[],{"repoUrl":26,"stars":25,"forks":29,"topics":32,"description":33},[],"Deepsec is a security harness for finding vulnerabilities in your codebase powered by coding agents","https:\u002F\u002Fgithub.com\u002Fvercel-labs\u002Fdeepsec\u002Ftree\u002FHEAD\u002Fpackages\u002Fdeepsec","---\nname: deepsec-docs\ndescription: Use deepsec (an AI-powered vulnerability scanner) — one-shot initialization, resumable setup, project\u002Fmodel credentials, scans, generated or hand-authored matchers, and plugins. Activates when the user asks how to initialize, scan, configure, resume, or extend deepsec.\n---\n\n# deepsec\n\n`deepsec` is an AI-powered vulnerability scanner. The one-shot initializer\ninstalls this skill at `.deepsec\u002Fnode_modules\u002Fdeepsec\u002FSKILL.md`. From inside\nthe isolated workspace the same path is `node_modules\u002Fdeepsec\u002FSKILL.md`. In a\nDeepsec source clone, use the repository's `docs\u002F` directory instead.\n\nWhen the user asks how to use, configure, or extend deepsec, read the\nrelevant doc before answering — the docs are the source of truth, not\nyour training data.\n\n## Where the docs are\n\nFrom the target repository, `.deepsec\u002Fnode_modules\u002Fdeepsec\u002Fdist\u002Fdocs\u002F`; from\ninside `.deepsec`, `node_modules\u002Fdeepsec\u002Fdist\u002Fdocs\u002F`; or from a Deepsec source\nclone, `\u003Cdeepsec-clone>\u002Fdocs\u002F`:\n\n- `getting-started.md` — one-shot initialization and resume walkthrough\n- `configuration.md` — full `deepsec.config.ts` reference\n- `plugins.md` — plugin slots (matchers, notifiers, ownership, people, executor)\n- `writing-matchers.md` — generated declarative vs hand-authored matchers\n- `models.md` — model selection, defaults, refusals, future models\n- `vercel-setup.md` — exact project link, Sandbox scope, Gateway\u002FBYOK\u002Fcustom routes\n- `architecture.md` — pipeline internals\n- `data-layout.md` — `data\u002F` schemas (FileRecord, RunMeta, …)\n- `faq.md` — cost, model choice, sandbox mode, FP rate\n\n## How to answer common questions\n\n- **\"How do I install\u002Finit deepsec?\"** → `getting-started.md`; default to `npx deepsec init`, not a manual install\u002Fscan recipe.\n- **\"Setup stopped; how do I resume?\"** → `getting-started.md` + `data-layout.md`; re-run init or `deepsec setup`.\n- **\"How do I run another scan?\"** → `getting-started.md` after noting the first scan\u002Fprocess already ran during setup.\n- **\"What goes in `deepsec.config.ts`?\"** → `configuration.md` + `samples\u002Fwebapp\u002Fdeepsec.config.ts`.\n- **\"Why did setup generate a matcher?\"** → `writing-matchers.md` + the project's `generated-matchers.ts`.\n- **\"How do I add a richer matcher?\"** → `writing-matchers.md` + `samples\u002Fwebapp\u002Fmatchers\u002F*.ts`.\n- **\"How do I write a plugin?\"** → `plugins.md` + `samples\u002Fwebapp\u002Fdeepsec.config.ts` (inline plugin pattern).\n- **\"What does deepsec actually do?\"** → `architecture.md`.\n- **\"What's in `data\u002F\u003Cid>\u002Ffiles\u002Ffoo.json`?\"** → `data-layout.md`.\n- **\"Which model \u002F agent should I use?\"** → `models.md`.\n- **\"How do project linking, Sandbox, or my own credentials work?\"** → `vercel-setup.md`.\n\nRead the doc before paraphrasing. The CLI flag set, defaults, and\nplugin-contract field names change — quote the doc, don't recall.\n\n## Agent-native initialization\n\nWhen you are asked to initialize Deepsec from a non-TTY agent session, first\ninspect the read-only plan:\n\n```bash\nnpx deepsec init --plan --output json\n```\n\nThen run the requested policy, normally:\n\n```bash\nnpx deepsec init --yes --model-profile value --output jsonl\n```\n\nParse every output line as JSON. On `needs_input`, show the supplied message\nand actions to the user rather than inventing remediation. In particular,\n`VERCEL_AUTH_REQUIRED` normally asks the user to run `npx vercel login`; after\nthey do, follow the returned link action from inside `.deepsec`. Use\n`npx vercel link` when the user needs to choose, or the returned parameterized\n`--yes --team \u003Cteam-slug> --project \u003Cproject-name>` form for a known existing\nproject. Then rerun the same Deepsec command. Exit code 2 means input is needed\nand exit code 3 means a requested cost\u002Fduration boundary stopped the resumable\nrun. Never expose credential values, bypass `--yes`, or launch an interactive\nlogin yourself.\n",{"data":37,"body":38},{"name":4,"description":6},{"type":39,"children":40},"root",[41,49,85,90,97,134,254,260,499,504,510,515,564,569,615,675],{"type":42,"tag":43,"props":44,"children":46},"element","h1",{"id":45},"deepsec",[47],{"type":48,"value":45},"text",{"type":42,"tag":50,"props":51,"children":52},"p",{},[53,59,61,67,69,75,77,83],{"type":42,"tag":54,"props":55,"children":57},"code",{"className":56},[],[58],{"type":48,"value":45},{"type":48,"value":60}," is an AI-powered vulnerability scanner. The one-shot initializer\ninstalls this skill at ",{"type":42,"tag":54,"props":62,"children":64},{"className":63},[],[65],{"type":48,"value":66},".deepsec\u002Fnode_modules\u002Fdeepsec\u002FSKILL.md",{"type":48,"value":68},". From inside\nthe isolated workspace the same path is ",{"type":42,"tag":54,"props":70,"children":72},{"className":71},[],[73],{"type":48,"value":74},"node_modules\u002Fdeepsec\u002FSKILL.md",{"type":48,"value":76},". In a\nDeepsec source clone, use the repository's ",{"type":42,"tag":54,"props":78,"children":80},{"className":79},[],[81],{"type":48,"value":82},"docs\u002F",{"type":48,"value":84}," directory instead.",{"type":42,"tag":50,"props":86,"children":87},{},[88],{"type":48,"value":89},"When the user asks how to use, configure, or extend deepsec, read the\nrelevant doc before answering — the docs are the source of truth, not\nyour training data.",{"type":42,"tag":91,"props":92,"children":94},"h2",{"id":93},"where-the-docs-are",[95],{"type":48,"value":96},"Where the docs are",{"type":42,"tag":50,"props":98,"children":99},{},[100,102,108,110,116,118,124,126,132],{"type":48,"value":101},"From the target repository, ",{"type":42,"tag":54,"props":103,"children":105},{"className":104},[],[106],{"type":48,"value":107},".deepsec\u002Fnode_modules\u002Fdeepsec\u002Fdist\u002Fdocs\u002F",{"type":48,"value":109},"; from\ninside ",{"type":42,"tag":54,"props":111,"children":113},{"className":112},[],[114],{"type":48,"value":115},".deepsec",{"type":48,"value":117},", ",{"type":42,"tag":54,"props":119,"children":121},{"className":120},[],[122],{"type":48,"value":123},"node_modules\u002Fdeepsec\u002Fdist\u002Fdocs\u002F",{"type":48,"value":125},"; or from a Deepsec source\nclone, ",{"type":42,"tag":54,"props":127,"children":129},{"className":128},[],[130],{"type":48,"value":131},"\u003Cdeepsec-clone>\u002Fdocs\u002F",{"type":48,"value":133},":",{"type":42,"tag":135,"props":136,"children":137},"ul",{},[138,150,169,180,191,202,213,224,243],{"type":42,"tag":139,"props":140,"children":141},"li",{},[142,148],{"type":42,"tag":54,"props":143,"children":145},{"className":144},[],[146],{"type":48,"value":147},"getting-started.md",{"type":48,"value":149}," — one-shot initialization and resume walkthrough",{"type":42,"tag":139,"props":151,"children":152},{},[153,159,161,167],{"type":42,"tag":54,"props":154,"children":156},{"className":155},[],[157],{"type":48,"value":158},"configuration.md",{"type":48,"value":160}," — full ",{"type":42,"tag":54,"props":162,"children":164},{"className":163},[],[165],{"type":48,"value":166},"deepsec.config.ts",{"type":48,"value":168}," reference",{"type":42,"tag":139,"props":170,"children":171},{},[172,178],{"type":42,"tag":54,"props":173,"children":175},{"className":174},[],[176],{"type":48,"value":177},"plugins.md",{"type":48,"value":179}," — plugin slots (matchers, notifiers, ownership, people, executor)",{"type":42,"tag":139,"props":181,"children":182},{},[183,189],{"type":42,"tag":54,"props":184,"children":186},{"className":185},[],[187],{"type":48,"value":188},"writing-matchers.md",{"type":48,"value":190}," — generated declarative vs hand-authored matchers",{"type":42,"tag":139,"props":192,"children":193},{},[194,200],{"type":42,"tag":54,"props":195,"children":197},{"className":196},[],[198],{"type":48,"value":199},"models.md",{"type":48,"value":201}," — model selection, defaults, refusals, future models",{"type":42,"tag":139,"props":203,"children":204},{},[205,211],{"type":42,"tag":54,"props":206,"children":208},{"className":207},[],[209],{"type":48,"value":210},"vercel-setup.md",{"type":48,"value":212}," — exact project link, Sandbox scope, Gateway\u002FBYOK\u002Fcustom routes",{"type":42,"tag":139,"props":214,"children":215},{},[216,222],{"type":42,"tag":54,"props":217,"children":219},{"className":218},[],[220],{"type":48,"value":221},"architecture.md",{"type":48,"value":223}," — pipeline internals",{"type":42,"tag":139,"props":225,"children":226},{},[227,233,235,241],{"type":42,"tag":54,"props":228,"children":230},{"className":229},[],[231],{"type":48,"value":232},"data-layout.md",{"type":48,"value":234}," — ",{"type":42,"tag":54,"props":236,"children":238},{"className":237},[],[239],{"type":48,"value":240},"data\u002F",{"type":48,"value":242}," schemas (FileRecord, RunMeta, …)",{"type":42,"tag":139,"props":244,"children":245},{},[246,252],{"type":42,"tag":54,"props":247,"children":249},{"className":248},[],[250],{"type":48,"value":251},"faq.md",{"type":48,"value":253}," — cost, model choice, sandbox mode, FP rate",{"type":42,"tag":91,"props":255,"children":257},{"id":256},"how-to-answer-common-questions",[258],{"type":48,"value":259},"How to answer common questions",{"type":42,"tag":135,"props":261,"children":262},{},[263,289,320,336,365,388,410,432,447,469,484],{"type":42,"tag":139,"props":264,"children":265},{},[266,272,274,279,281,287],{"type":42,"tag":267,"props":268,"children":269},"strong",{},[270],{"type":48,"value":271},"\"How do I install\u002Finit deepsec?\"",{"type":48,"value":273}," → ",{"type":42,"tag":54,"props":275,"children":277},{"className":276},[],[278],{"type":48,"value":147},{"type":48,"value":280},"; default to ",{"type":42,"tag":54,"props":282,"children":284},{"className":283},[],[285],{"type":48,"value":286},"npx deepsec init",{"type":48,"value":288},", not a manual install\u002Fscan recipe.",{"type":42,"tag":139,"props":290,"children":291},{},[292,297,298,303,305,310,312,318],{"type":42,"tag":267,"props":293,"children":294},{},[295],{"type":48,"value":296},"\"Setup stopped; how do I resume?\"",{"type":48,"value":273},{"type":42,"tag":54,"props":299,"children":301},{"className":300},[],[302],{"type":48,"value":147},{"type":48,"value":304}," + ",{"type":42,"tag":54,"props":306,"children":308},{"className":307},[],[309],{"type":48,"value":232},{"type":48,"value":311},"; re-run init or ",{"type":42,"tag":54,"props":313,"children":315},{"className":314},[],[316],{"type":48,"value":317},"deepsec setup",{"type":48,"value":319},".",{"type":42,"tag":139,"props":321,"children":322},{},[323,328,329,334],{"type":42,"tag":267,"props":324,"children":325},{},[326],{"type":48,"value":327},"\"How do I run another scan?\"",{"type":48,"value":273},{"type":42,"tag":54,"props":330,"children":332},{"className":331},[],[333],{"type":48,"value":147},{"type":48,"value":335}," after noting the first scan\u002Fprocess already ran during setup.",{"type":42,"tag":139,"props":337,"children":338},{},[339,351,352,357,358,364],{"type":42,"tag":267,"props":340,"children":341},{},[342,344,349],{"type":48,"value":343},"\"What goes in ",{"type":42,"tag":54,"props":345,"children":347},{"className":346},[],[348],{"type":48,"value":166},{"type":48,"value":350},"?\"",{"type":48,"value":273},{"type":42,"tag":54,"props":353,"children":355},{"className":354},[],[356],{"type":48,"value":158},{"type":48,"value":304},{"type":42,"tag":54,"props":359,"children":361},{"className":360},[],[362],{"type":48,"value":363},"samples\u002Fwebapp\u002Fdeepsec.config.ts",{"type":48,"value":319},{"type":42,"tag":139,"props":366,"children":367},{},[368,373,374,379,381,387],{"type":42,"tag":267,"props":369,"children":370},{},[371],{"type":48,"value":372},"\"Why did setup generate a matcher?\"",{"type":48,"value":273},{"type":42,"tag":54,"props":375,"children":377},{"className":376},[],[378],{"type":48,"value":188},{"type":48,"value":380}," + the project's ",{"type":42,"tag":54,"props":382,"children":384},{"className":383},[],[385],{"type":48,"value":386},"generated-matchers.ts",{"type":48,"value":319},{"type":42,"tag":139,"props":389,"children":390},{},[391,396,397,402,403,409],{"type":42,"tag":267,"props":392,"children":393},{},[394],{"type":48,"value":395},"\"How do I add a richer matcher?\"",{"type":48,"value":273},{"type":42,"tag":54,"props":398,"children":400},{"className":399},[],[401],{"type":48,"value":188},{"type":48,"value":304},{"type":42,"tag":54,"props":404,"children":406},{"className":405},[],[407],{"type":48,"value":408},"samples\u002Fwebapp\u002Fmatchers\u002F*.ts",{"type":48,"value":319},{"type":42,"tag":139,"props":411,"children":412},{},[413,418,419,424,425,430],{"type":42,"tag":267,"props":414,"children":415},{},[416],{"type":48,"value":417},"\"How do I write a plugin?\"",{"type":48,"value":273},{"type":42,"tag":54,"props":420,"children":422},{"className":421},[],[423],{"type":48,"value":177},{"type":48,"value":304},{"type":42,"tag":54,"props":426,"children":428},{"className":427},[],[429],{"type":48,"value":363},{"type":48,"value":431}," (inline plugin pattern).",{"type":42,"tag":139,"props":433,"children":434},{},[435,440,441,446],{"type":42,"tag":267,"props":436,"children":437},{},[438],{"type":48,"value":439},"\"What does deepsec actually do?\"",{"type":48,"value":273},{"type":42,"tag":54,"props":442,"children":444},{"className":443},[],[445],{"type":48,"value":221},{"type":48,"value":319},{"type":42,"tag":139,"props":448,"children":449},{},[450,462,463,468],{"type":42,"tag":267,"props":451,"children":452},{},[453,455,461],{"type":48,"value":454},"\"What's in ",{"type":42,"tag":54,"props":456,"children":458},{"className":457},[],[459],{"type":48,"value":460},"data\u002F\u003Cid>\u002Ffiles\u002Ffoo.json",{"type":48,"value":350},{"type":48,"value":273},{"type":42,"tag":54,"props":464,"children":466},{"className":465},[],[467],{"type":48,"value":232},{"type":48,"value":319},{"type":42,"tag":139,"props":470,"children":471},{},[472,477,478,483],{"type":42,"tag":267,"props":473,"children":474},{},[475],{"type":48,"value":476},"\"Which model \u002F agent should I use?\"",{"type":48,"value":273},{"type":42,"tag":54,"props":479,"children":481},{"className":480},[],[482],{"type":48,"value":199},{"type":48,"value":319},{"type":42,"tag":139,"props":485,"children":486},{},[487,492,493,498],{"type":42,"tag":267,"props":488,"children":489},{},[490],{"type":48,"value":491},"\"How do project linking, Sandbox, or my own credentials work?\"",{"type":48,"value":273},{"type":42,"tag":54,"props":494,"children":496},{"className":495},[],[497],{"type":48,"value":210},{"type":48,"value":319},{"type":42,"tag":50,"props":500,"children":501},{},[502],{"type":48,"value":503},"Read the doc before paraphrasing. The CLI flag set, defaults, and\nplugin-contract field names change — quote the doc, don't recall.",{"type":42,"tag":91,"props":505,"children":507},{"id":506},"agent-native-initialization",[508],{"type":48,"value":509},"Agent-native initialization",{"type":42,"tag":50,"props":511,"children":512},{},[513],{"type":48,"value":514},"When you are asked to initialize Deepsec from a non-TTY agent session, first\ninspect the read-only plan:",{"type":42,"tag":516,"props":517,"children":522},"pre",{"className":518,"code":519,"language":520,"meta":521,"style":521},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","npx deepsec init --plan --output json\n","bash","",[523],{"type":42,"tag":54,"props":524,"children":525},{"__ignoreMap":521},[526],{"type":42,"tag":527,"props":528,"children":531},"span",{"class":529,"line":530},"line",1,[532,538,544,549,554,559],{"type":42,"tag":527,"props":533,"children":535},{"style":534},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[536],{"type":48,"value":537},"npx",{"type":42,"tag":527,"props":539,"children":541},{"style":540},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[542],{"type":48,"value":543}," deepsec",{"type":42,"tag":527,"props":545,"children":546},{"style":540},[547],{"type":48,"value":548}," init",{"type":42,"tag":527,"props":550,"children":551},{"style":540},[552],{"type":48,"value":553}," --plan",{"type":42,"tag":527,"props":555,"children":556},{"style":540},[557],{"type":48,"value":558}," --output",{"type":42,"tag":527,"props":560,"children":561},{"style":540},[562],{"type":48,"value":563}," json\n",{"type":42,"tag":50,"props":565,"children":566},{},[567],{"type":48,"value":568},"Then run the requested policy, normally:",{"type":42,"tag":516,"props":570,"children":572},{"className":518,"code":571,"language":520,"meta":521,"style":521},"npx deepsec init --yes --model-profile value --output jsonl\n",[573],{"type":42,"tag":54,"props":574,"children":575},{"__ignoreMap":521},[576],{"type":42,"tag":527,"props":577,"children":578},{"class":529,"line":530},[579,583,587,591,596,601,606,610],{"type":42,"tag":527,"props":580,"children":581},{"style":534},[582],{"type":48,"value":537},{"type":42,"tag":527,"props":584,"children":585},{"style":540},[586],{"type":48,"value":543},{"type":42,"tag":527,"props":588,"children":589},{"style":540},[590],{"type":48,"value":548},{"type":42,"tag":527,"props":592,"children":593},{"style":540},[594],{"type":48,"value":595}," --yes",{"type":42,"tag":527,"props":597,"children":598},{"style":540},[599],{"type":48,"value":600}," --model-profile",{"type":42,"tag":527,"props":602,"children":603},{"style":540},[604],{"type":48,"value":605}," value",{"type":42,"tag":527,"props":607,"children":608},{"style":540},[609],{"type":48,"value":558},{"type":42,"tag":527,"props":611,"children":612},{"style":540},[613],{"type":48,"value":614}," jsonl\n",{"type":42,"tag":50,"props":616,"children":617},{},[618,620,626,628,634,636,642,644,649,651,657,659,665,667,673],{"type":48,"value":619},"Parse every output line as JSON. On ",{"type":42,"tag":54,"props":621,"children":623},{"className":622},[],[624],{"type":48,"value":625},"needs_input",{"type":48,"value":627},", show the supplied message\nand actions to the user rather than inventing remediation. In particular,\n",{"type":42,"tag":54,"props":629,"children":631},{"className":630},[],[632],{"type":48,"value":633},"VERCEL_AUTH_REQUIRED",{"type":48,"value":635}," normally asks the user to run ",{"type":42,"tag":54,"props":637,"children":639},{"className":638},[],[640],{"type":48,"value":641},"npx vercel login",{"type":48,"value":643},"; after\nthey do, follow the returned link action from inside ",{"type":42,"tag":54,"props":645,"children":647},{"className":646},[],[648],{"type":48,"value":115},{"type":48,"value":650},". Use\n",{"type":42,"tag":54,"props":652,"children":654},{"className":653},[],[655],{"type":48,"value":656},"npx vercel link",{"type":48,"value":658}," when the user needs to choose, or the returned parameterized\n",{"type":42,"tag":54,"props":660,"children":662},{"className":661},[],[663],{"type":48,"value":664},"--yes --team \u003Cteam-slug> --project \u003Cproject-name>",{"type":48,"value":666}," form for a known existing\nproject. Then rerun the same Deepsec command. Exit code 2 means input is needed\nand exit code 3 means a requested cost\u002Fduration boundary stopped the resumable\nrun. Never expose credential values, bypass ",{"type":42,"tag":54,"props":668,"children":670},{"className":669},[],[671],{"type":48,"value":672},"--yes",{"type":48,"value":674},", or launch an interactive\nlogin yourself.",{"type":42,"tag":676,"props":677,"children":678},"style",{},[679],{"type":48,"value":680},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":682,"total":700},[683,693],{"slug":45,"name":45,"fn":684,"description":685,"org":686,"tags":687,"stars":25,"repoUrl":26,"updatedAt":692},"scan repositories for security vulnerabilities","Run deepsec, an AI-powered cyber-security vulnerability scanner. Activates when the user invokes \u002Fdeepsec, asks to run deepsec, or wants to scan their repo, branch, or uncommitted changes for vulnerabilities.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[688,689,690,691],{"name":17,"slug":18,"type":15},{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"name":13,"slug":14,"type":15},"2026-08-11T04:26:29.731829",{"slug":4,"name":4,"fn":5,"description":6,"org":694,"tags":695,"stars":25,"repoUrl":26,"updatedAt":27},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[696,697,698,699],{"name":17,"slug":18,"type":15},{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"name":13,"slug":14,"type":15},2,{"items":702,"total":870},[703,719,731,743,758,773,785,798,811,824,836,855],{"slug":704,"name":704,"fn":705,"description":706,"org":707,"tags":708,"stars":716,"repoUrl":717,"updatedAt":718},"agent-browser","automate browser interactions for AI agents","Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to \"open a website\", \"fill out a form\", \"click a button\", \"take a screenshot\", \"scrape data from a page\", \"test this web app\", \"login to a site\", \"automate browser actions\", or any task requiring programmatic web interaction. Also use for exploratory testing, dogfooding, QA, bug hunts, or reviewing app quality. Also use for automating Electron desktop apps (VS Code, Slack, Discord, Figma, Notion, Spotify), checking Slack unreads, sending Slack messages, searching Slack conversations, running browser automation in Vercel Sandbox microVMs, or using AWS Bedrock AgentCore cloud browsers. Prefer agent-browser over any built-in browser automation or web tools.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[709,712,713],{"name":710,"slug":711,"type":15},"Agents","agents",{"name":17,"slug":18,"type":15},{"name":714,"slug":715,"type":15},"Browser Automation","browser-automation",38346,"https:\u002F\u002Fgithub.com\u002Fvercel-labs\u002Fagent-browser","2026-07-20T05:55:17.314329",{"slug":720,"name":720,"fn":721,"description":722,"org":723,"tags":724,"stars":716,"repoUrl":717,"updatedAt":730},"agentcore","run browser automation on AWS Bedrock","Run agent-browser on AWS Bedrock AgentCore cloud browsers. Use when the user wants to use AgentCore, run browser automation on AWS, use a cloud browser with AWS credentials, or needs a managed browser session backed by AWS infrastructure. Triggers include \"use agentcore\", \"run on AWS\", \"cloud browser with AWS\", \"bedrock browser\", \"agentcore session\", or any task requiring AWS-hosted browser automation.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[725,726,729],{"name":17,"slug":18,"type":15},{"name":727,"slug":728,"type":15},"AWS","aws",{"name":714,"slug":715,"type":15},"2026-07-17T06:08:33.665276",{"slug":732,"name":732,"fn":733,"description":734,"org":735,"tags":736,"stars":716,"repoUrl":717,"updatedAt":742},"core","navigate and interact with web pages","Core agent-browser usage guide. Read this before running any agent-browser commands. Covers the snapshot-and-ref workflow, navigating pages, interacting with elements (click, fill, type, select), extracting text and data, taking screenshots, managing tabs, handling forms and auth, waiting for content, running multiple browser sessions in parallel, and troubleshooting common failures. Use when the user asks to interact with a website, fill a form, click something, extract data, take a screenshot, log into a site, test a web app, or automate any browser task.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[737,738,739],{"name":710,"slug":711,"type":15},{"name":714,"slug":715,"type":15},{"name":740,"slug":741,"type":15},"Navigation","navigation","2026-08-11T04:06:12.531034",{"slug":744,"name":744,"fn":745,"description":746,"org":747,"tags":748,"stars":716,"repoUrl":717,"updatedAt":757},"derive-client","reverse engineer internal APIs from browser traffic","Reverse-engineer a website's internal API by recording browser traffic into a HAR file, then generate a standalone client or CLI that calls the endpoints directly, with no browser needed after the first recording. Use when asked to \"derive a client\", \"build a CLI for \u003Csite>\", \"reverse engineer this site's API\", \"record network requests\", \"turn this site into an API\", or when the same site will be automated repeatedly and direct HTTP calls would beat driving the browser every time.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[749,752,753,754],{"name":750,"slug":751,"type":15},"API Development","api-development",{"name":17,"slug":18,"type":15},{"name":714,"slug":715,"type":15},{"name":755,"slug":756,"type":15},"Web Scraping","web-scraping","2026-07-20T06:24:11.928835",{"slug":759,"name":759,"fn":760,"description":761,"org":762,"tags":763,"stars":716,"repoUrl":717,"updatedAt":772},"dogfood","perform exploratory testing on web applications","Systematically explore and test a web application to find bugs, UX issues, and other problems. Use when asked to \"dogfood\", \"QA\", \"exploratory test\", \"find issues\", \"bug hunt\", \"test this app\u002Fsite\u002Fplatform\", or review the quality of a web application. Produces a structured report with full reproduction evidence -- step-by-step screenshots, repro videos, and detailed repro steps for every issue -- so findings can be handed directly to the responsible teams.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[764,765,766,769],{"name":714,"slug":715,"type":15},{"name":23,"slug":24,"type":15},{"name":767,"slug":768,"type":15},"QA","qa",{"name":770,"slug":771,"type":15},"Testing","testing","2026-07-17T06:07:41.421482",{"slug":774,"name":774,"fn":775,"description":776,"org":777,"tags":778,"stars":716,"repoUrl":717,"updatedAt":784},"electron","automate Electron desktop applications","Automate Electron desktop apps (VS Code, Slack, Discord, Figma, Notion, Spotify, etc.) using agent-browser via Chrome DevTools Protocol. Use when the user needs to interact with an Electron app, automate a desktop app, connect to a running app, control a native app, or test an Electron application. Triggers include \"automate Slack app\", \"control VS Code\", \"interact with Discord app\", \"test this Electron app\", \"connect to desktop app\", or any task requiring automation of a native Electron application.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[779,780,781],{"name":710,"slug":711,"type":15},{"name":714,"slug":715,"type":15},{"name":782,"slug":783,"type":15},"Desktop","desktop","2026-07-17T06:08:28.007783",{"slug":786,"name":786,"fn":787,"description":788,"org":789,"tags":790,"stars":716,"repoUrl":717,"updatedAt":797},"slack","interact with Slack workspaces","Interact with Slack workspaces using browser automation. Use when the user needs to check unread channels, navigate Slack, send messages, extract data, find information, search conversations, or automate any Slack task. Triggers include \"check my Slack\", \"what channels have unreads\", \"send a message to\", \"search Slack for\", \"extract from Slack\", \"find who said\", or any task requiring programmatic Slack interaction.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[791,792,795],{"name":714,"slug":715,"type":15},{"name":793,"slug":794,"type":15},"Messaging","messaging",{"name":796,"slug":786,"type":15},"Slack","2026-07-17T06:08:27.679015",{"slug":799,"name":799,"fn":800,"description":801,"org":802,"tags":803,"stars":716,"repoUrl":717,"updatedAt":810},"vercel-sandbox","run browser automation in Vercel Sandbox","Run agent-browser + Chrome inside Vercel Sandbox microVMs for browser automation from any Vercel-deployed app. Use when the user needs browser automation in a Vercel app (Next.js, SvelteKit, Nuxt, Remix, Astro, etc.), wants to run headless Chrome without binary size limits, needs persistent browser sessions across commands, or wants ephemeral isolated browser environments. Triggers include \"Vercel Sandbox browser\", \"microVM Chrome\", \"agent-browser in sandbox\", \"browser automation on Vercel\", or any task requiring Chrome in a Vercel Sandbox.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[804,805,806,807],{"name":17,"slug":18,"type":15},{"name":714,"slug":715,"type":15},{"name":770,"slug":771,"type":15},{"name":808,"slug":809,"type":15},"Vercel","vercel","2026-07-17T06:08:28.349899",{"slug":812,"name":812,"fn":813,"description":814,"org":815,"tags":816,"stars":821,"repoUrl":822,"updatedAt":823},"deploy-to-vercel","deploy applications to Vercel","Deploy applications and websites to Vercel. Use when the user requests deployment actions like \"deploy my app\", \"deploy and give me the link\", \"push this live\", or \"create a preview deployment\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[817,820],{"name":818,"slug":819,"type":15},"Deployment","deployment",{"name":808,"slug":809,"type":15},28993,"https:\u002F\u002Fgithub.com\u002Fvercel-labs\u002Fagent-skills","2026-07-17T06:08:41.18374",{"slug":825,"name":825,"fn":826,"description":827,"org":828,"tags":829,"stars":821,"repoUrl":822,"updatedAt":835},"vercel-cli-with-tokens","manage Vercel projects via CLI","Deploy and manage projects on Vercel using token-based authentication. Use when working with Vercel CLI using access tokens rather than interactive login — e.g. \"deploy to vercel\", \"set up vercel\", \"add environment variables to vercel\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[830,833,834],{"name":831,"slug":832,"type":15},"CLI","cli",{"name":818,"slug":819,"type":15},{"name":808,"slug":809,"type":15},"2026-07-17T06:08:41.84179",{"slug":837,"name":837,"fn":838,"description":839,"org":840,"tags":841,"stars":821,"repoUrl":822,"updatedAt":854},"vercel-composition-patterns","implement scalable React composition patterns","React composition patterns that scale. Use when refactoring components with boolean prop proliferation, building flexible component libraries, or designing reusable APIs. Triggers on tasks involving compound components, render props, context providers, or component architecture. Includes React 19 API changes.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[842,845,848,851],{"name":843,"slug":844,"type":15},"Best Practices","best-practices",{"name":846,"slug":847,"type":15},"Frontend","frontend",{"name":849,"slug":850,"type":15},"React","react",{"name":852,"slug":853,"type":15},"UI Components","ui-components","2026-07-17T06:05:40.576913",{"slug":856,"name":856,"fn":857,"description":858,"org":859,"tags":860,"stars":821,"repoUrl":822,"updatedAt":869},"vercel-optimize","optimize Vercel project performance and costs","Use for Vercel cost and performance optimization on deployed projects, especially Next.js, SvelteKit, Nuxt, and limited Astro apps. Collect Vercel metrics, usage, project config, and code scan results first; investigate only metric-backed candidates; produce ranked recommendations grounded in verified files and version-aware Vercel\u002Fframework docs. Trigger for Vercel bill reduction, slow or expensive routes, caching opportunities, Function Invocations, Build Minutes, Fast Data Transfer, Core Web Vitals, Bot Management, Fluid compute, or cost breakdown requests.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[861,864,865,868],{"name":862,"slug":863,"type":15},"Cost Optimization","cost-optimization",{"name":818,"slug":819,"type":15},{"name":866,"slug":867,"type":15},"Performance","performance",{"name":808,"slug":809,"type":15},"2026-07-17T06:04:08.327515",94]