ohmyzsh/ohmyzsh

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

15 of your 33 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 4.16s · analysis 9.54s · 7.1 MB · GitHub API rate-limit (preflight)

https://github.com/ohmyzsh/ohmyzsh · scanned 2026-06-05 04:33 UTC (5 hours, 28 minutes ago) · 10 languages

67 findings (29 legacy + 38 scanner) 75th percentile · Python · tiny (<2K LoC) Scanner says 75 (lower by 4)

File as issue Image v2 schema

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 5 hours, 28 minutes ago · v2 · 48 findings from 2 sources. Findings combine the legacy security pipeline AND the multi-layer engine (atlas, wiring, flows, ranked) AND verified AI agent contributions.

JSON

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	65.0	0.15	9.75
`security_score`	55.0	0.25	13.75
`testing_score`	70.0	0.20	14.00
`documentation_score`	93.0	0.15	13.95
`practices_score`	81.0	0.15	12.15
`code_quality`	73.7	0.10	7.37
Overall		1.00	71.0

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 8 High 10 Medium 5 Low 14 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Legacy 29 9-layer 19 Crowd 0 Layer: Software 9 Quality 27 Security 7 Api 1 Network 1 Frontend 1 Cicd 2

Exclude dismissed / FP Exclude test files

All 1231 nodes from the latest scan, grouped by kind. Each node is a unit the engine identified (file, function, endpoint, table…). Most users won't need this view — it's primarily for debugging the engine's graph extraction or for AI agents that want to enumerate the project structure.

Label	Layer	Status	Path
`oh-my-zsh.sh`	software	healthy	`oh-my-zsh.sh`
`README.md`	software	healthy	`README.md`
`CONTRIBUTING.md`	software	healthy	`CONTRIBUTING.md`
`CODE_OF_CONDUCT.md`	software	healthy	`CODE_OF_CONDUCT.md`
`SECURITY.md`	software	healthy	`SECURITY.md`
`devcontainer.json`	software	healthy	`.devcontainer/devcontainer.json`
`completion.zsh`	software	healthy	`lib/completion.zsh`
`directories.zsh`	software	healthy	`lib/directories.zsh`
`bzr.zsh`	software	healthy	`lib/bzr.zsh`
`termsupport.zsh`	software	healthy	`lib/termsupport.zsh`
`prompt_info_functions.zsh`	software	healthy	`lib/prompt_info_functions.zsh`
`theme-and-appearance.zsh`	software	healthy	`lib/theme-and-appearance.zsh`
`functions.zsh`	software	healthy	`lib/functions.zsh`
`spectrum.zsh`	software	healthy	`lib/spectrum.zsh`
`misc.zsh`	software	healthy	`lib/misc.zsh`
`grep.zsh`	software	healthy	`lib/grep.zsh`
`cli.zsh`	software	healthy	`lib/cli.zsh`
`async_prompt.zsh`	software	healthy	`lib/async_prompt.zsh`
`nvm.zsh`	software	healthy	`lib/nvm.zsh`
`clipboard.zsh`	software	healthy	`lib/clipboard.zsh`
`git.zsh`	software	healthy	`lib/git.zsh`
`vcs_info.zsh`	software	healthy	`lib/vcs_info.zsh`
`key-bindings.zsh`	software	healthy	`lib/key-bindings.zsh`
`history.zsh`	software	healthy	`lib/history.zsh`
`correction.zsh`	software	healthy	`lib/correction.zsh`
`diagnostics.zsh`	software	healthy	`lib/diagnostics.zsh`
`compfix.zsh`	software	healthy	`lib/compfix.zsh`
`cli.test.zsh`	software	healthy	`lib/tests/cli.test.zsh`
`example.zsh`	software	healthy	`custom/example.zsh`
`example.plugin.zsh`	software	healthy	`custom/plugins/example/example.plugin.zsh`
`theme_chooser.sh`	software	healthy	`tools/theme_chooser.sh`
`require_tool.sh`	software	healthy	`tools/require_tool.sh`
`install.sh`	software	healthy	`tools/install.sh`
`changelog.sh`	software	healthy	`tools/changelog.sh`
`uninstall.sh`	software	healthy	`tools/uninstall.sh`
`upgrade.sh`	software	healthy	`tools/upgrade.sh`
`check_for_upgrade.sh`	software	healthy	`tools/check_for_upgrade.sh`
`dependencies.yml`	software	healthy	`.github/dependencies.yml`
`INCIDENT_RESPONSE_PLAN.md`	software	healthy	`.github/INCIDENT_RESPONSE_PLAN.md`
`PULL_REQUEST_TEMPLATE.md`	software	healthy	`.github/PULL_REQUEST_TEMPLATE.md`
`FUNDING.yml`	software	healthy	`.github/FUNDING.yml`
`dependabot.yml`	software	healthy	`.github/dependabot.yml`
`bug_report_omz.yml`	software	healthy	`.github/ISSUE_TEMPLATE/bug_report_omz.yml`
`bug_report.yml`	software	healthy	`.github/ISSUE_TEMPLATE/bug_report.yml`
`config.yml`	software	healthy	`.github/ISSUE_TEMPLATE/config.yml`
`feature_request.yml`	software	healthy	`.github/ISSUE_TEMPLATE/feature_request.yml`
`project.yml`	software	healthy	`.github/workflows/project.yml`
`dependencies.yml`	software	healthy	`.github/workflows/dependencies.yml`
`installer.yml`	software	healthy	`.github/workflows/installer.yml`
`scorecard.yml`	software	healthy	`.github/workflows/scorecard.yml`

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

Label	Layer	Status	Path
`.devcontainer`	software	healthy	`.devcontainer`
`lib`	software	healthy	`lib`
`tests`	software	healthy	`lib/tests`
`custom`	software	healthy	`custom`
`plugins`	software	healthy	`custom/plugins`
`example`	software	healthy	`custom/plugins/example`
`tools`	software	healthy	`tools`
`.github`	software	healthy	`.github`
`ISSUE_TEMPLATE`	software	healthy	`.github/ISSUE_TEMPLATE`
`workflows`	software	healthy	`.github/workflows`
`dependencies`	software	healthy	`.github/workflows/dependencies`
`installer`	software	healthy	`.github/workflows/installer`
`plugins`	software	healthy	`plugins`
`fzf`	software	healthy	`plugins/fzf`
`colemak`	software	healthy	`plugins/colemak`
`kompose`	software	healthy	`plugins/kompose`
`genpass`	software	healthy	`plugins/genpass`
`skaffold`	software	healthy	`plugins/skaffold`
`tmux-cssh`	software	healthy	`plugins/tmux-cssh`
`cloudfoundry`	software	healthy	`plugins/cloudfoundry`
`nestjs`	software	healthy	`plugins/nestjs`
`microk8s`	software	healthy	`plugins/microk8s`
`node`	software	healthy	`plugins/node`
`cp`	software	healthy	`plugins/cp`
`operator-sdk`	software	healthy	`plugins/operator-sdk`
`bundler`	software	healthy	`plugins/bundler`
`dotnet`	software	healthy	`plugins/dotnet`
`hanami`	software	healthy	`plugins/hanami`
`xcode`	software	healthy	`plugins/xcode`
`mix`	software	healthy	`plugins/mix`
`argocd`	software	healthy	`plugins/argocd`
`systemd`	software	healthy	`plugins/systemd`
`nmap`	software	healthy	`plugins/nmap`
`jruby`	software	healthy	`plugins/jruby`
`octozen`	software	healthy	`plugins/octozen`
`emoji-clock`	software	healthy	`plugins/emoji-clock`
`ubuntu`	software	healthy	`plugins/ubuntu`
`docker`	software	healthy	`plugins/docker`
`git-auto-fetch`	software	healthy	`plugins/git-auto-fetch`
`rclone`	software	healthy	`plugins/rclone`
`perms`	software	healthy	`plugins/perms`
`yii2`	software	healthy	`plugins/yii2`
`pass`	software	healthy	`plugins/pass`
`eecms`	software	healthy	`plugins/eecms`
`composer`	software	healthy	`plugins/composer`
`thefuck`	software	healthy	`plugins/thefuck`
`vault`	software	healthy	`plugins/vault`
`emoji`	software	healthy	`plugins/emoji`
`arduino-cli`	software	healthy	`plugins/arduino-cli`
`powder`	software	healthy	`plugins/powder`

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

Label	Layer	Status	Path
`coerce`	software	healthy	`.github/workflows/dependencies/updater.py:44`
`__init__`	software	healthy	`.github/workflows/dependencies/updater.py:166`
`__enter__`	software	healthy	`.github/workflows/dependencies/updater.py:63`
`__exit__`	software	healthy	`.github/workflows/dependencies/updater.py:66`
`str_presenter`	software	dead	`.github/workflows/dependencies/updater.py:72`
`run_or_fail`	software	healthy	`.github/workflows/dependencies/updater.py:121`
`set`	software	healthy	`.github/workflows/dependencies/updater.py:143`
`update_dependency_version`	software	healthy	`.github/workflows/dependencies/updater.py:147`
`write_store`	software	healthy	`.github/workflows/dependencies/updater.py:160`
`__str__`	software	healthy	`.github/workflows/dependencies/updater.py:186`
`update_or_notify`	software	healthy	`.github/workflows/dependencies/updater.py:201`
`__update_yaml`	software	healthy	`.github/workflows/dependencies/updater.py:297`
`__apply_upstream_changes`	software	healthy	`.github/workflows/dependencies/updater.py:301`
`clone`	software	healthy	`.github/workflows/dependencies/updater.py:351`
`checkout_or_create_branch`	software	healthy	`.github/workflows/dependencies/updater.py:368`
`repo_is_clean`	software	healthy	`.github/workflows/dependencies/updater.py:389`
`add_and_commit`	software	healthy	`.github/workflows/dependencies/updater.py:405`
`push`	software	healthy	`.github/workflows/dependencies/updater.py:443`
`clean_repo`	software	healthy	`.github/workflows/dependencies/updater.py:449`
`check_newer_tag`	software	healthy	`.github/workflows/dependencies/updater.py:460`
`check_updates`	software	healthy	`.github/workflows/dependencies/updater.py:521`
`create_issue`	software	healthy	`.github/workflows/dependencies/updater.py:554`
`create_pr`	software	healthy	`.github/workflows/dependencies/updater.py:559`
`main`	software	healthy	`.github/workflows/dependencies/updater.py:597`
`code_to_omz`	software	healthy	`plugins/emoji/update_emoji.py:75`
`name_to_omz`	software	healthy	`plugins/emoji/update_emoji.py:79`
`snake_case`	software	healthy	`plugins/emoji/update_emoji.py:81`
`increment_name`	software	healthy	`plugins/emoji/update_emoji.py:106`
`get_tagname_or_hash`	software	healthy	`plugins/git-prompt/gitstatus.py:10`
`get_stash`	software	healthy	`plugins/git-prompt/gitstatus.py:28`
`colored`	software	healthy	`plugins/aliases/termcolor.py:86`
`cprint`	software	healthy	`plugins/aliases/termcolor.py:118`
`parse`	software	healthy	`plugins/aliases/cheatsheet.py:7`
`cheatsheet`	software	healthy	`plugins/aliases/cheatsheet.py:18`
`pretty_print_group`	software	healthy	`plugins/aliases/cheatsheet.py:33`
`pretty_print`	software	healthy	`plugins/aliases/cheatsheet.py:50`
`make_argv`	software	healthy	`plugins/shell-proxy/ssh-proxy.py:23`
`get_http_proxy`	software	healthy	`plugins/shell-proxy/proxy.py:17`
`make_proxies`	software	healthy	`plugins/shell-proxy/proxy.py:37`
`merge`	software	healthy	`plugins/shell-proxy/proxy.py:46`
`enable`	software	dead	`plugins/shell-proxy/proxy.py:57`
`disable`	software	dead	`plugins/shell-proxy/proxy.py:61`
`status`	software	dead	`plugins/shell-proxy/proxy.py:65`
`usage`	software	healthy	`plugins/shell-proxy/proxy.py:74`
`cmdline`	software	healthy	`plugins/shell-proxy/proxy.py:78`
`main`	software	healthy	`plugins/shell-proxy/proxy.py:82`

Label	Layer	Status	Path
`CodeTimer`	software	healthy	`.github/workflows/dependencies/updater.py:59`
`DependencyDict`	software	healthy	`.github/workflows/dependencies/updater.py:87`
`DependencyYAML`	software	healthy	`.github/workflows/dependencies/updater.py:95`
`UpdateStatusFalse`	software	healthy	`.github/workflows/dependencies/updater.py:99`
`UpdateStatusTrue`	software	healthy	`.github/workflows/dependencies/updater.py:103`
`CommandRunner`	software	healthy	`.github/workflows/dependencies/updater.py:111`
`Exception`	software	healthy	`.github/workflows/dependencies/updater.py:112`
`DependencyStore`	software	healthy	`.github/workflows/dependencies/updater.py:139`
`Dependency`	software	healthy	`.github/workflows/dependencies/updater.py:165`
`Git`	software	healthy	`.github/workflows/dependencies/updater.py:347`
`GitHub`	software	healthy	`.github/workflows/dependencies/updater.py:458`
`CommandSet`	software	healthy	`plugins/shell-proxy/proxy.py:50`

Label	Layer	Status	Path
`vps::droplet`	hardware	healthy	`plugins/emoji/gemoji_db.json`
`vps::gcp`	hardware	healthy	`plugins/gnu-utils/gnu-utils.plugin.zsh`
`vps::digitalocean`	hardware	healthy	`plugins/doctl/doctl.plugin.zsh`
`vps::aws`	hardware	healthy	`plugins/aws/aws.plugin.zsh`
`vps::ec2`	hardware	healthy	`plugins/aws/aws.plugin.zsh`
`vps::hetzner`	hardware	healthy	`plugins/hcloud/hcloud.plugin.zsh`
`vps::azure`	hardware	healthy	`plugins/azure/azure.plugin.zsh`

Label	Layer	Status	Path
`add-to-project`	cicd	healthy	`.github/workflows/project.yml`
`check`	cicd	healthy	`.github/workflows/dependencies.yml`
`test`	cicd	healthy	`.github/workflows/installer.yml`
`deploy`	cicd	healthy	`.github/workflows/installer.yml`
`analysis`	cicd	healthy	`.github/workflows/scorecard.yml`
`tests`	cicd	healthy	`.github/workflows/main.yml`

Label	Layer	Status	Path
`gha::project`	cicd	healthy	`.github/workflows/project.yml`
`gha::dependencies`	cicd	healthy	`.github/workflows/dependencies.yml`
`gha::installer`	cicd	healthy	`.github/workflows/installer.yml`
`gha::scorecard`	cicd	healthy	`.github/workflows/scorecard.yml`
`gha::main`	cicd	healthy	`.github/workflows/main.yml`

Label	Layer	Status	Path
`VERCEL_TOKEN`	cicd	healthy	`—`
`OHMYZSH_APP_PRIVATE_KEY`	cicd	healthy	`—`
`VERCEL_PROJECT_ID`	cicd	healthy	`—`
`OHMYZSH_CLIENT_ID`	cicd	healthy	`—`
`VERCEL_ORG_ID`	cicd	healthy	`—`

Label	Layer	Status	Path
`port:01`	network	healthy	`plugins/battery/battery.plugin.zsh`
`port:12`	network	healthy	`plugins/battery/battery.plugin.zsh`
`port:02`	network	healthy	`plugins/battery/battery.plugin.zsh`
`port:03`	network	healthy	`plugins/battery/battery.plugin.zsh`

Label	Layer	Status	Path
`password_literal::plugins/wd/wd.sh`	security	healthy	`plugins/wd/wd.sh`
`password_literal::plugins/wp-cli/wp-cli.plugin.zsh`	security	healthy	`plugins/wp-cli/wp-cli.plugin.zsh`
`password_literal::plugins/drush/drush.plugin.zsh`	security	healthy	`plugins/drush/drush.plugin.zsh`

Label	Layer	Status	Path
`loadbalancer`	network	healthy	`plugins/hcloud/hcloud.plugin.zsh`
`nginx`	network	healthy	`plugins/systemadmin/systemadmin.plugin.zsh`

Label	Layer	Status	Path
`repobility-clone-i5foekmy`	software	healthy	`/tmp/repobility-clone-i5foekmy`

Label	Layer	Status	Path
`127.0.0.1`	network	healthy	`plugins/systemadmin/systemadmin.plugin.zsh`

Label	Layer	Status	Path
`gpu (detected)`	hardware	healthy	`plugins/git/git.plugin.zsh`

Label	Layer	Status	Path
`auth::plugins/emoji/gemoji_db.json`	security	healthy	`plugins/emoji/gemoji_db.json`

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/b387ada8-9962-4839-a2be-d5dbb09d4cdd/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/b387ada8-9962-4839-a2be-d5dbb09d4cdd/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.

ohmyzsh/ohmyzsh

Complete repo analysis

file 50+

directory 50+

function 46

class 12

vps 7

job 6

pipeline 5

env_var 5

port 4

secret 3

load_balancer 2

repo 1

service 1

gpu 1

auth 1