Ai

Oh My OpenAgent v4.4.0: New Automated Security Research Skill

Oh My OpenAgent v4.4.0: New Automated Security Research Skill

Oh My OpenAgent just got a serious upgrade. Version 4.4.0 ships with /security-research, a new skill that turns your AI agent into a full adversarial security team. Think of it as a red team in a box — five agents working in parallel to find vulnerabilities, score them by exploitability, and map findings to real-world standards. No more manual pen-testing checklists. This is automated security research that actually tries to break things.

What Changed

The /security-research command spins up a five-member team: three vulnerability hunters (surface, auth/data, runtime/supply) and two proof-of-concept engineers. They don't just scan for known flaws. They reason about attack paths. Every finding is calibrated by actual exploitability — no severity without an actionable route. It's powered by CWE classification, OWASP WSTG and ASVS methodologies, and CVSS v4.0 scoring. All results are delivered in a structured report.

There's a catch: you need team_mode.enabled: true in your oh-my-opencode.jsonc config. This isn't a toy. It's for teams serious about security automation.

Why It Matters

Security research is slow, expensive, and requires rare expertise. Most automated tools just flag common vulnerabilities — they don't think like an attacker. This skill changes that. It's not just a scanner; it's a reasoning engine that simulates adversarial tactics. For DevOps and security engineers, it means continuous, deep security testing without the overhead of assembling a full red team. And because it uses CVSS v4.0, you get consistent scoring that matches industry standards.

But here's the real kicker: it runs in parallel. Five agents don't wait for each other. They probe different attack surfaces simultaneously. That's a major time save. I've seen teams spend weeks on a single application security review. This could shrink that to hours. Of course, it's not a silver bullet — automated reasoning has limits. But for initial triage and continuous regression testing, it's a game-changer. Oh My OpenAgent is betting big on agent collaboration, and this release proves it's more than a gimmick.

Official Source: https://github.com/code-yeongyu/oh-my-openagent/releases/tag/v4.4.0