oma-deepsec

Drive Vercel's `deepsec` agent-powered vulnerability scanner end-to-end: installing the `.deepsec/` workspace, bootstrapping `INFO.md`, running cost-aware `scan` / `process` / `triage` / `revalidate` / `export` passes, gating PRs with `process --diff`, writing custom matchers, and triaging findings. Use whenever the user mentions deepsec, asks an agent to scan a repo for vulnerabilities, runs into `pnpm deepsec` / `bunx deepsec` commands, wants a CI-based PR security review, sees a `.deepsec/` directory, or asks about `INFO.md` / matchers / `process --diff` / `revalidate`, even when the tool name is not spoken. Deepsec scans are expensive (a single full scan can cost hundreds to tens of thousands of dollars) so the skill exists in part to keep the user from getting surprised.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a dense, highly actionable operator manual with strong workflow sequencing and validation, though slightly repetitive. Progressive disclosure is well designed but its referenced resource files are absent from the bundle, so the navigation cannot be completed.

Suggestions

Deduplicate the calibration and agent-choice guidance: state the --limit 50 --concurrency 5 recommendation and the codex-vs-claude trade-off once and cross-reference them elsewhere instead of restating in Scenes, Transitions, Canonical workflow, and Guardrails.

Add the referenced resources/ files (setup.md, scanning.md, pr-review.md, matchers.md, triage.md, config.md) and the ../_shared/* files to the bundle so the progressive-disclosure navigation is actually reachable, or inline the essential parts of the missing files into SKILL.md.

Tighten the Scheduling section's Intent signature / When to use / When NOT to use lists, which overlap with the description and the Scenes list, to reduce token cost without losing trigger coverage.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and dense with deepsec-specific knowledge Claude would not know (cost bands, resume semantics, two-job CI pattern), but recurring repetition (e.g. the --limit 50 --concurrency 5 calibration advice restated ~4 times, the agent-choice trade-off in both Scenes and Guardrails) could be tightened; not score 3 because some tokens do not earn their place twice, not score 1 because it does not explain generic concepts or pad.	2 / 3
Actionability	Provides fully executable bash blocks (e.g. "bunx deepsec init", "bunx deepsec process --diff origin/${BASE_REF} --comment-out comment.md"), specific flags, file paths, and quantified matcher hit-rate targets (1-20 hits / 1k files for precise); not score 2 because the guidance is copy-paste ready rather than pseudocode.	3 / 3
Workflow Clarity	Clear sequenced workflow (Bootstrap -> Calibrate -> Full investigation -> PR mode -> Matchers -> Resume) with explicit validation checkpoints (deepsec status, RunMeta, exit codes 0/1/other) and feedback loops for quota, refusal, and high-FP recovery; not score 2 because checkpoints are explicit, not implicit.	3 / 3
Progressive Disclosure	The body is an overview with one-level-deep, clearly signaled references to resources/.md and ../_shared/ files, but none of those referenced files (nor references/, scripts/, assets/ directories) are present in the actual bundle, so the offloaded detail cannot be navigated or verified; not score 3 because the promised detail files are missing, not score 1 because references are one level deep and well organized rather than deeply nested.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, trigger-rich, and fully answers both what and when with an explicit Use-when clause and a clear distinct niche. It is a strong, well-scoped skill description.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions ("installing the .deepsec/ workspace, bootstrapping INFO.md, running cost-aware scan/process/triage/revalidate/export passes, gating PRs with process --diff, writing custom matchers, and triaging findings"), matching the score-3 anchor; not score 2 because it goes well beyond naming the domain and a few actions.	3 / 3
Completeness	Explicitly answers both what (drive the scanner end-to-end with concrete verbs) and when ("Use whenever the user mentions deepsec, asks an agent to scan a repo for vulnerabilities..."), with an explicit trigger clause; not score 2 because the when is explicit, not merely implied.	3 / 3
Trigger Term Quality	Covers natural variations users would say ("mentions deepsec", "asks an agent to scan a repo for vulnerabilities", "pnpm deepsec / bunx deepsec", "CI-based PR security review", "sees a .deepsec/ directory", "INFO.md / matchers / process --diff / revalidate", "even when the tool name is not spoken"); not score 2 because common variations are present rather than partially missing.	3 / 3
Distinctiveness Conflict Risk	A clear niche (the deepsec scanner, the .deepsec/ directory, bunx deepsec commands) with distinct triggers unlikely to fire for general QA or architecture skills; not score 2 because it would not meaningfully overlap with adjacent skills.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: first-fluke/oh-my-agent
Path: .agents/skills/oma-deepsec/SKILL.md
Commit: 3021301

Reviewed: about 24 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.