omp-security

oh-my-pi's security_scan tool for the DeepSeek Harness (DSH). It plans and runs security reviews of the workspace with real scanners plus an AI triage pass, produces a P0–P3 prioritized report, and keeps findings so they can be validated later.

Flow

security_scan {"action":"preflight","target_kind":"working_tree"}
→ Plan plan-3fa1c2 — working_tree at /repo
  Scope: 4 file(s): api.py, db.py, …
  Scanners: ✓ semgrep ✓ bandit ✓ gitleaks – osv-scanner (not applicable) …
security_scan {"action":"start","plan_id":"plan-3fa1c2"}
→ Security scan scan-2026-10-10-9b1e (operation op-77c0): completed; 3 finding(s) — 0 critical, 2 high, 1 medium …
  AI review (omni/claude-sonnet): Fix the shell injection in api.py first …
  1. [P1 high] subprocess call with shell=True identified, security issue.
     api.py:41 · bandit B602 · CWE-78 · id 4be1c0a9d2
     AI: tp — user input reaches the shell
     Fix: pass an argv list and shell=False

Action	Purpose
`preflight`	Pin the scope: `target_kind` = `repository` (default), `scoped_path` (+`include_paths`), `working_tree` (uncommitted changes), `ref_diff` (`base_revision`..`head_revision`). Optional `exclude_paths`, `scanners` subset, `ai_review`. Returns a `plan_id` and which scanners apply
`start`	Run the plan in the background. Waits up to `wait_seconds` (default 20) and returns the report or progress plus an `operation_id`
`status`	`operation_id` or `scan_id`; `wait_seconds`, `min_severity`, `max_findings`
`cancel`	Stop a running operation
`validate`	Record a verdict on a finding: `scan_id`, `finding_id`, `validation_status` (`validated`/`rejected`/`partial`/`unvalidated`/`error`), `validation_summary`, optional `validation_evidence`
`list`	Recent scans
`scanners`	Installed scanners and install hints

AI review: a reviewer model (the agent's own model by default, or reviewProvider/reviewModel) gets:

every finding with surrounding code;
the diff (for working_tree/ref_diff) or the scoped files.

It marks each finding as true or false positive with a reason and a concrete fix, adjusts severity, and adds up to 10 issues the scanners missed. False positives are hidden from the report but kept in the stored scan.

Scans are stored as JSON in ~/.dsh/security-scans/.

Scanners

Scanner	What it finds	Install
semgrep	SAST rules for 30+ languages (`p/default`)	`pip install --user semgrep`
bandit	Python security issues	`pip install --user bandit`
gitleaks	Hard-coded secrets (git history for `repository` scans)	releases → `~/.local/bin`
osv-scanner	Vulnerable dependencies from lockfiles (npm, pnpm, yarn, pip, poetry, go, cargo, maven, …)	releases → `~/.local/bin`
npm audit	npm advisories for `package-lock.json` projects	bundled with npm

Missing scanners are skipped and listed in the preflight with install hints.

Installation

dsh plugin --profile web add git+https://git.rizzy.dev/DSH-Plugins/omp-security.git

Or in the Web UI, go to Settings → Plugins → Install. For development, use link: to a clone. Restart DSH afterwards.

Configuration

- id: omp-security
  config:
    aiReview: true
    reviewProvider: ''        # empty = the calling agent's provider
    reviewModel: ''           # empty = the calling agent's model
    semgrepConfig: p/default  # any semgrep --config value (registry pack, file, dir)
    maxReviewFindings: 60

Tests

npm test runs a scan of a deliberately vulnerable sample with bandit and gitleaks (stubbed reviewer), plus osv-scanner against a vulnerable requirements.txt.

3.8 KiB Raw Permalink Blame History Unescape Escape