Omv

omv

oh-my-vul local-first vulnerability research project manager for Claude Code.

Commands

/omv list                   — list all installed omv-* skills with one-line descriptions
/omv dashboard              — show workspace, active workflow queue, and recent activity
/omv status                 — show local .omv workspace status (delegates to omv CLI)
/omv log                    — show local workspace activity log (delegates to omv CLI)
/omv next                   — show active findings and recommended next actions
/omv audit              — deep-audit a candidate finding (delegates to omv-audit skill)
/omv repro              — guide local reproduction of a finding (delegates to omv-repro skill)
/omv repro init         — create .omv/repro// artifact scaffold
/omv review             — review report readiness and recommend the next step
/omv report artifacts   — check report and reproduction artifacts
/omv verification init  — create .omv/verifications/.yaml adversarial review scaffold
/omv verification show  — show adversarial verification status
/omv verification validate 
                            — validate Verification.v1 and stale Evidence hash
/omv archive  --reason 
                            — archive an inactive finding (delegates to omv CLI)
/omv restore            — restore an archived finding (delegates to omv CLI)
/omv findings list          — list .omv/findings evidence files (delegates to omv CLI)
/omv findings workflow      — show lifecycle next actions (delegates to omv CLI)
/omv findings doctor    — advanced readiness diagnostics
/omv findings show      — show one finding's validation state and next action
/omv findings open      — print one finding YAML path for editing
/omv findings init      — create a finding template (delegates to omv CLI)
/omv findings validate [id] — validate one or all findings (delegates to omv CLI)
/omv findings promote   — update finding status (delegates to omv CLI)
/omv help                   — show this help text

The first word after /omv is treated as the subcommand. Unknown subcommands show the help text.

Skills in This Collection

| Skill | Invocation | Purpose | |---|---|---| | omv-find | /omv-find | Find and rank open-source packages worth auditing | | omv-audit | /omv-audit | Deep-audit a candidate finding, prove or disprove the vulnerability | | omv-repro | /omv-repro | Guide local reproduction, fill evidence.observed_result | | omv-report | /omv-report | Generate VulDB/CVE/GHSA/OSV advisory reports |

Registry

Collection metadata lives in references/registry.yaml. Read it to show current version, platform requirements, and per-skill produces/consumes fields.

State Directory

.omv/ at the repository root stores findings, archive metadata, and the rebuildable local workspace index. It is private local research state and should be gitignored. Active findings live under .omv/findings/; inactive findings live under .omv/archive/findings/.

CLI Delegation

When the user invokes workspace, lifecycle, repro scaffold, artifact check, archive, or restore commands, run the matching omv CLI command via Bash and display its output. Do not implement the behavior manually (do not mkdir, do not move files, do not write YAML directly).

Use omv help, omv help review, omv help findings, omv help repro, or omv help report as the source of truth for exact CLI signatures. For direct aliases:

• /omv dashboard -> omv dashboard
• /omv status -> omv workspace status
• /omv log -> omv workspace log
• /omv next -> omv findings workflow
• /omv repro init -> omv repro init
• /omv review -> omv review
• /omv report artifacts -> omv report artifacts
• /omv verification init -> omv verification init
• /omv verification show -> omv verification show
• /omv verification validate -> omv verification validate
• /omv archive --reason -> omv findings archive --reason
• /omv restore -> omv findings restore
• /omv findings ... -> omv findings ...

If omv is not found on PATH, output: "omv is not installed. Run: npx oh-my-vul setup"

Subcommand reference

• dashboard — prints workspace status, active workflow queue, and recent activity in one view.
• workspace status — prints workspace path, active/archive counts, status counts, and privacy warnings.
• workspace log — prints the local activity trail for workspace init, finding init, promotion, archive, and restore.
• **init `** — creates .omv/findings/.yaml from the Evidence.v1 template; default --status candidate. If file exists, CLI errors — suggest --force`.
• list — prints ID / STATUS / READY / PACKAGE / VULNERABILITY table for every .yaml in .omv/findings/.
• workflow — prints active findings sorted by priority with NEXT ACTION recommendations such as /omv-audit, /omv-repro, /omv-report, promotion, or archive.
• **review `** — runs the unified pre-report readiness review and returns one verdict: ready, needs-repro, needs-audit, needs-verification, or blocked. Use --strict` when adversarial Verification.v1 must pass before reporting.
• doctor `` — advanced diagnostics for score deductions, unresolved blockers, suspicious CVSS/guard choices, sidecar validation, and artifact gaps. JSON mode is available for CI.
• **show `** — prints one finding's package, vulnerability, validation errors/warnings, missing fields, and next action. Use --archived` to inspect archived findings.
• open `` — prints the Evidence.v1 YAML path and next action so the user can edit or inspect the local file.
• validate [id|path] — checks required Evidence.v1 fields; exits non-zero on errors. No arg = validate whole ledger.
• promote --status — updates the status field and re-validates. Valid statuses: candidate, confirmed, blocked.
• **repro init `** — creates .omv/repro// with standard reproduction artifact files and records suggested evidence.repro_artifacts`.
• **report artifacts `** — checks .omv/reports//` and Evidence.v1 reproduction artifact references before final archive.
• **verification init `** — creates .omv/verifications/.yaml` with the current Evidence.v1 SHA-256 for adversarial verifier review.
• verification show `` — summarizes Verification.v1 decision, disagreements, required changes, and stale-hash state.
• verification validate `` — validates Verification.v1 structure and warns when Evidence.v1 changed after review.
• archive --reason — moves a finding to .omv/archive/findings/ and removes it from active workflow views. For --reason reported, confirmed findings reuse omv report artifacts checks; use --strict to block archive when artifacts are missing or empty.
• archive list — lists archived findings and archive reasons.
• **restore `** — moves an archived finding back to .omv/findings/`.

Workflow Overview

/omv-find  →  identifies candidates
              writes .omv/findings/.yaml  (status: candidate)
                        ↓
/omv-audit →  deep-audits the finding: dataflow trace, guard verification,
              PoC description, CVSS scoring, dedup search
              updates .omv/findings/.yaml  (status: confirmed | blocked | candidate)
                        ↓
/omv-repro →  [optional] guides local reproduction when observed_result is unknown
              walks user through execution, records observed_result
              updates .omv/findings/.yaml  (status: confirmed | blocked)
                        ↓
/omv review → checks Evidence.v1 plus available ThreatMap.v1 / Verification.v1
              returns ready | needs-repro | needs-audit | needs-verification | blocked
                        ↓
/omv-report → reads confirmed finding, generates VulDB/CVE/GHSA/OSV report
                        ↓
archive    → omv findings archive  --reason reported

Each finding uses one of three Evidence.v1 statuses: candidate, confirmed, or blocked. Use omv dashboard, omv findings workflow, or /omv next as the canonical active queue view after each stage. When the user asks whether a specific finding can be reported, run omv review first and follow its verdict. When the CLI prints a priority value, follow the highest-priority row first unless the user names a specific finding.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: bx33661
• Source: bx33661/oh-my-vul
• License: MIT

Install and usage instructions live in the source repository linked above.