Omd Sast
确定性 semgrep 静态扫描(SAST)+ 结构化报告。零 LLM 零成本,规则命中即事实。Trigger:/omd-sast、静态扫描、semgrep、扫一下代码。
Install
$ agentstack add skill-abysscn-oh-my-dag-omd-sast ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-abysscn-oh-my-dag-omd-sast) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
/omd-sast — semgrep 静态扫描
对应 pi TUI 的 /omd-sast。确定性工具,直接 Bash 跑 semgrep(装了才可用;没装提示 pip install semgrep 或 brew):
semgrep scan --config auto --json --quiet 2>/dev/null- 解析 JSON 输出,按严重度分组转述:
file:line+ 规则 id + 一句话问题 + 修复方向; - 零命中就说零命中,不要脑补;规则误报常见——对高严重度命中读代码确认真实可达再定性;
- 与 /omd-audit 互补:sast 是规则事实(便宜、确定),audit 是语义审查(贵、覆盖设计层)。先 sast 后 audit 是省钱顺序。
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: AbyssCN
- Source: AbyssCN/oh-my-dag
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.