# Omd Sast

> 确定性 semgrep 静态扫描(SAST)+ 结构化报告。零 LLM 零成本,规则命中即事实。Trigger:/omd-sast、静态扫描、semgrep、扫一下代码。

- **Type:** Skill
- **Install:** `agentstack add skill-abysscn-oh-my-dag-omd-sast`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [AbyssCN](https://agentstack.voostack.com/s/abysscn)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [AbyssCN](https://github.com/AbyssCN)
- **Source:** https://github.com/AbyssCN/oh-my-dag/tree/main/client-skills/omd-sast

## Install

```sh
agentstack add skill-abysscn-oh-my-dag-omd-sast
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# /omd-sast — semgrep 静态扫描

对应 pi TUI 的 `/omd-sast`。确定性工具,直接 Bash 跑 semgrep(装了才可用;没装提示 `pip install semgrep` 或 brew):

```bash
semgrep scan --config auto --json --quiet  2>/dev/null
```

- 解析 JSON 输出,按严重度分组转述:`file:line` + 规则 id + 一句话问题 + 修复方向;
- 零命中就说零命中,不要脑补;规则误报常见——对高严重度命中读代码确认真实可达再定性;
- 与 /omd-audit 互补:sast 是规则事实(便宜、确定),audit 是语义审查(贵、覆盖设计层)。先 sast 后 audit 是省钱顺序。

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [AbyssCN](https://github.com/AbyssCN)
- **Source:** [AbyssCN/oh-my-dag](https://github.com/AbyssCN/oh-my-dag)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-abysscn-oh-my-dag-omd-sast
- Seller: https://agentstack.voostack.com/s/abysscn
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.