KillerB Security Plugin

OpenCode security plugin for network scanning, code auditing, dependency checking, threat intelligence lookups, and automated security reporting.

Install

npm install @killerb/security

Then register it in your OpenCode configuration:

{
  "plugins": ["@killerb/security"]
}

Tools

| Tool | Description | |---|---| | port-scan | Scans target host for open ports from a known service list | | code-review | Scans a directory for secrets, dangerous commands, and sensitive files | | deps-check | Analyzes package.json for loose version constraints | | hash-lookup | Looks up file hashes against VirusTotal / AlienVault OTX | | report-gen | Generates structured security reports from findings |

Hooks

• env-protect — Blocks destructive commands before execution
• compaction-summary — Injects plugin state into context summaries

Architecture

src/
├── index.ts              # Plugin entry & tool/hook registration
│
├── agents/               # Scan + audit agents
├── tools/                # Tool implementations (5 tools)
│
├── services/             # Logger, filesystem, network, threat intel
├── config/               # Plugin configuration
│
├── types/                # Type definitions (Finding, Report, Module, etc.)
├── interfaces/           # Abstract contracts
├── events/               # Event bus
├── constants/            # Shared constants
├── utils/                # Helpers (hash, risk score, report builder)
│
├── core/                 # Core framework
│   ├── events/           # Typed event bus
│   ├── profile/          # Audit profile manager (OWASP, NIST, CIS, etc.)
│   ├── policy-engine/    # Policy rule evaluation
│   ├── permissions/      # Permission check system
│   ├── capability-registry/  # Plugin capability registry
│   └── plugin-sdk/       # Plugin host SDK
│
├── playbooks/            # Playbook system
│   ├── loader/           # YAML/JSON playbook loader
│   ├── executor/         # Step executor (serial, parallel, rollback)
│   └── templates/        # Built-in playbook templates
│
├── reporting/            # Report engine (SARIF, Markdown, JSON, CSV)
├── evidence/             # Evidence reference manager
│
├── hooks/                # Lifecycle hooks
│
├── modules/              # Extensible security modules
│   ├── web/              # Headers, JWT, CSP scanners
│   ├── recon/            # DNS, subdomain enumeration
│   ├── intelligence/     # CVE lookup, CVSS scoring
│   ├── code/             # SAST, secret scanning
│   └── cloud/            # AWS security checks
│
├── ai/                   # AI-powered features
│   ├── planner/          # Audit plan generation
│   ├── correlator/       # Finding correlation
│   ├── summarizer/       # Executive summaries
│   └── remediation/      # Remediation plans
│
├── devsecops/            # DevSecOps integrations
│   └── github/           # GitHub Actions security audit
│
├── automation/           # Automation runner
├── workflows/            # Workflow engine
├── integration/          # OpenCode bridge
│
├── adapters/             # External API adapters
└── prompts/              # LLM prompts per agent

Development

npm install
npm run build   # compile TypeScript
npm run lint    # type-check only
npm test        # run tests

License

MIT