oma-deepsec

Drive Vercel's `deepsec` agent-powered vulnerability scanner end-to-end: installing the `.deepsec/` workspace, bootstrapping `INFO.md`, running cost-aware `scan` / `process` / `triage` / `revalidate` / `export` passes, gating PRs with `process --diff`, writing custom matchers, and triaging findings. Use whenever the user mentions deepsec, asks an agent to scan a repo for vulnerabilities, runs into `pnpm deepsec` / `bunx deepsec` commands, wants a CI-based PR security review, sees a `.deepsec/` directory, or asks about `INFO.md` / matchers / `process --diff` / `revalidate`, even when the tool name is not spoken. Deepsec scans are expensive (a single full scan can cost hundreds to tens of thousands of dollars) so the skill exists in part to keep the user from getting surprised.

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A strong, actionable, well-sequenced skill body with excellent command-level guidance and validation/cost-guard feedback loops. Minor conciseness loss from cross-section repetition and a progressive-disclosure score held back only by the inability to verify the referenced resource files in this bundle.

Suggestions

De-duplicate the calibration (`--limit 50 --concurrency 5`) and agent-choice-prompt guidance: state each once in Guardrails and reference it from Scheduling/Scenes rather than repeating full text.

Consolidate the failure/recovery table into `resources/troubleshoot.md` (already referenced) and keep only the top 3-4 most common failures inline, reducing body length.

Ensure every `resources/*.md` file named in the References section actually ships in the bundle so the progressive-disclosure pointers resolve.

Dimension	Reasoning	Score
Conciseness	Largely lean and assumes Claude's competence — no definitional filler, inline commands — but ~250 lines with repetition across Scheduling/Scenes/Guardrails (the `--limit 50` calibration advice and agent-choice prompt each recur 3-4 times), so it could be tightened.	4 / 5
Actionability	Copy-paste-ready bash blocks for bootstrap, calibration, full process, PR mode; concrete matcher hit-rate bands (1-20/1k for precise) and named env vars give fully executable guidance across the common cases.	5 / 5
Workflow Clarity	Clear entry→scenes→transitions→exit sequence with explicit validation checkpoints (`deepsec status`, RunMeta, exit-code semantics, cost forecast before any AI pass) and a thorough failure/recovery table providing feedback loops for this high-cost batch operation.	5 / 5
Progressive Disclosure	A clear References section points one level deep to `resources/*.md`, upstream docs, and shared files, with the body acting as an overview; the `resources/` bundle is not present in this review to verify the referenced files, and some inline detail (e.g., the failure table) could arguably live in a resource.	4 / 5
	Total	18 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

An exemplary frontmatter description: concrete capability list, dense natural trigger terms, explicit 'Use when...' guidance, and a clear distinct niche. Third-person voice is maintained throughout.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — installing the `.deepsec/` workspace, bootstrapping `INFO.md`, running `scan`/`process`/`triage`/`revalidate`/`export`, gating PRs with `process --diff`, writing matchers, triaging findings — covering the tool's surface comprehensively.	5 / 5
Completeness	Explicitly answers both 'what' (the enumerated action list) and 'when' ('Use whenever the user mentions...') with concrete trigger phrases, and adds a cost-surprise rationale.	5 / 5
Trigger Term Quality	Dense natural trigger coverage: 'deepsec', 'scan a repo for vulnerabilities', `pnpm deepsec`/`bunx deepsec`, 'CI-based PR security review', `.deepsec/` directory, `INFO.md`, matchers, `process --diff`, `revalidate`, plus the explicit 'even when the tool name is not spoken' clause.	5 / 5
Distinctiveness Conflict Risk	The deepsec-specific triggers and command forms carve a clear niche with minimal overlap risk; written in third person ('Drive...') with no first/second-person drift.	5 / 5
	Total	20 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: first-fluke/oh-my-agent
Path: .agents/skills/oma-deepsec/SKILL.md
Commit: 032c988

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.