74 lines
3.8 KiB
Markdown
74 lines
3.8 KiB
Markdown
# omp-security
|
||
|
||
[oh-my-pi](https://github.com/can1357/oh-my-pi)'s `security_scan` tool for the DeepSeek Harness (DSH). It plans and runs security reviews of the workspace with real scanners plus an **AI triage pass**, produces a **P0–P3 prioritized report**, and keeps findings so they can be validated later.
|
||
|
||
## Flow
|
||
|
||
```
|
||
security_scan {"action":"preflight","target_kind":"working_tree"}
|
||
→ Plan plan-3fa1c2 — working_tree at /repo
|
||
Scope: 4 file(s): api.py, db.py, …
|
||
Scanners: ✓ semgrep ✓ bandit ✓ gitleaks – osv-scanner (not applicable) …
|
||
security_scan {"action":"start","plan_id":"plan-3fa1c2"}
|
||
→ Security scan scan-2026-10-10-9b1e (operation op-77c0): completed; 3 finding(s) — 0 critical, 2 high, 1 medium …
|
||
AI review (omni/claude-sonnet): Fix the shell injection in api.py first …
|
||
1. [P1 high] subprocess call with shell=True identified, security issue.
|
||
api.py:41 · bandit B602 · CWE-78 · id 4be1c0a9d2
|
||
AI: tp — user input reaches the shell
|
||
Fix: pass an argv list and shell=False
|
||
```
|
||
|
||
| Action | Purpose |
|
||
| --- | --- |
|
||
| `preflight` | Pin the scope: `target_kind` = `repository` (default), `scoped_path` (+`include_paths`), `working_tree` (uncommitted changes), `ref_diff` (`base_revision`..`head_revision`). Optional `exclude_paths`, `scanners` subset, `ai_review`. Returns a `plan_id` and which scanners apply |
|
||
| `start` | Run the plan in the background. Waits up to `wait_seconds` (default 20) and returns the report or progress plus an `operation_id` |
|
||
| `status` | `operation_id` or `scan_id`; `wait_seconds`, `min_severity`, `max_findings` |
|
||
| `cancel` | Stop a running operation |
|
||
| `validate` | Record a verdict on a finding: `scan_id`, `finding_id`, `validation_status` (`validated`/`rejected`/`partial`/`unvalidated`/`error`), `validation_summary`, optional `validation_evidence` |
|
||
| `list` | Recent scans |
|
||
| `scanners` | Installed scanners and install hints |
|
||
|
||
**AI review:** a reviewer model (the agent's own model by default, or `reviewProvider`/`reviewModel`) gets:
|
||
- every finding with surrounding code;
|
||
- the diff (for `working_tree`/`ref_diff`) or the scoped files.
|
||
|
||
It marks each finding as true or false positive with a reason and a concrete fix, adjusts severity, and adds up to 10 issues the scanners missed. False positives are hidden from the report but kept in the stored scan.
|
||
|
||
Scans are stored as JSON in `~/.dsh/security-scans/`.
|
||
|
||
## Scanners
|
||
|
||
| Scanner | What it finds | Install |
|
||
| --- | --- | --- |
|
||
| semgrep | SAST rules for 30+ languages (`p/default`) | `pip install --user semgrep` |
|
||
| bandit | Python security issues | `pip install --user bandit` |
|
||
| gitleaks | Hard-coded secrets (git history for `repository` scans) | [releases](https://github.com/gitleaks/gitleaks/releases) → `~/.local/bin` |
|
||
| osv-scanner | Vulnerable dependencies from lockfiles (npm, pnpm, yarn, pip, poetry, go, cargo, maven, …) | [releases](https://github.com/google/osv-scanner/releases) → `~/.local/bin` |
|
||
| npm audit | npm advisories for `package-lock.json` projects | bundled with npm |
|
||
|
||
Missing scanners are skipped and listed in the preflight with install hints.
|
||
|
||
## Installation
|
||
|
||
```bash
|
||
dsh plugin --profile web add git+https://git.rizzy.dev/DSH-Plugins/omp-security.git
|
||
```
|
||
|
||
Or in the Web UI, go to **Settings → Plugins → Install**. For development, use `link:` to a clone. Restart DSH afterwards.
|
||
|
||
## Configuration
|
||
|
||
```yaml
|
||
- id: omp-security
|
||
config:
|
||
aiReview: true
|
||
reviewProvider: '' # empty = the calling agent's provider
|
||
reviewModel: '' # empty = the calling agent's model
|
||
semgrepConfig: p/default # any semgrep --config value (registry pack, file, dir)
|
||
maxReviewFindings: 60
|
||
```
|
||
|
||
## Tests
|
||
|
||
`npm test` runs a scan of a deliberately vulnerable sample with bandit and gitleaks (stubbed reviewer), plus osv-scanner against a vulnerable `requirements.txt`.
|