# Oma Security

Scan application source, agent skills, and MCP components; run penetration tests...

- Repository: https://github.com/first-fluke/oh-my-agent (1356 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add first-fluke/oh-my-agent --skill oma-security -g -a claude-code -y`
Codex: `npx skills add first-fluke/oh-my-agent --skill oma-security -g -a codex -y`
Cursor: `npx skills add first-fluke/oh-my-agent --skill oma-security -g -a cursor -y`
Gemini CLI: `npx skills add first-fluke/oh-my-agent --skill oma-security -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add first-fluke/oh-my-agent`

## Description

Scan application source, agent skills, and MCP components; run penetration tests against scoped web test deployments, validate findings, and configure scan gates. Use oma-qa for broad quality reviews and domain skills for remediation.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Security Scanning and Validation

## Scheduling

### Goal
Run the selected security checks, retain their native evidence, independently validate candidates, and report findings and coverage on the recorded source or deployment identity.

### Intent signature
- Requests to scan a repository, agent skill package, MCP component, or web test deployment for vulnerabilities.
- Explicit Deepsec, Cisco Skill Scanner, Cisco MCP Scanner, Cisco AI Deep SAST, ARTEX, or Cloudflare security-audit-skill requests.
- Security scan setup, scoped PR/diff analysis, finding triage/reproduction, scanner failures, or security CI gates.

### When to use
- Scan application source or a source diff; inspect skill packages or MCP components.
- Run a bounded runtime penetration test against a concrete authorized test deployment.
- Validate scanner candidates, retain evidence, or configure an engine-specific CI gate.
- Troubleshoot the selected scanner, credentials, coverage, matchers, quota, or resumable state.

### When NOT to use
- Broad correctness, performance, accessibility, or quality review -> `oma-qa`.
- External tool comparisons or research without execution -> `oma-search`.
- Security architecture decisions -> `oma-architecture`.
- Product-code remediation -> `oma-debug` or the owning backend/frontend/mobile/infrastructure skill.
- A security question or a repository's existence alone does not request a scan.

The rest: https://github.com/first-fluke/oh-my-agent/blob/HEAD/.agents/skills/oma-security/SKILL.md