# Omv

> oh-my-vul local-first vulnerability research project manager. Shows workspace status, next actions, installed omv-* skills, registry info, and delegates .omv findings lifecycle commands. Use when the user types /omv, asks what to do next, or manages local findings.

- **Type:** Skill
- **Install:** `agentstack add skill-bx33661-oh-my-vul-omv`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [bx33661](https://agentstack.voostack.com/s/bx33661)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [bx33661](https://github.com/bx33661)
- **Source:** https://github.com/bx33661/oh-my-vul/tree/main/skills/omv

## Install

```sh
agentstack add skill-bx33661-oh-my-vul-omv
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# omv

oh-my-vul local-first vulnerability research project manager for Claude Code.

## Commands

```text
/omv list                   — list all installed omv-* skills with one-line descriptions
/omv dashboard              — show workspace, active workflow queue, and recent activity
/omv status                 — show local .omv workspace status (delegates to omv CLI)
/omv log                    — show local workspace activity log (delegates to omv CLI)
/omv next                   — show active findings and recommended next actions
/omv audit              — deep-audit a candidate finding (delegates to omv-audit skill)
/omv repro              — guide local reproduction of a finding (delegates to omv-repro skill)
/omv repro init         — create .omv/repro// artifact scaffold
/omv review             — review report readiness and recommend the next step
/omv report artifacts   — check report and reproduction artifacts
/omv verification init  — create .omv/verifications/.yaml adversarial review scaffold
/omv verification show  — show adversarial verification status
/omv verification validate 
                            — validate Verification.v1 and stale Evidence hash
/omv archive  --reason 
                            — archive an inactive finding (delegates to omv CLI)
/omv restore            — restore an archived finding (delegates to omv CLI)
/omv findings list          — list .omv/findings evidence files (delegates to omv CLI)
/omv findings workflow      — show lifecycle next actions (delegates to omv CLI)
/omv findings doctor    — advanced readiness diagnostics
/omv findings show      — show one finding's validation state and next action
/omv findings open      — print one finding YAML path for editing
/omv findings init      — create a finding template (delegates to omv CLI)
/omv findings validate [id] — validate one or all findings (delegates to omv CLI)
/omv findings promote   — update finding status (delegates to omv CLI)
/omv help                   — show this help text
```

The first word after `/omv` is treated as the subcommand. Unknown subcommands show the help text.

## Skills in This Collection

| Skill | Invocation | Purpose |
|---|---|---|
| omv-find | `/omv-find` | Find and rank open-source packages worth auditing |
| omv-audit | `/omv-audit` | Deep-audit a candidate finding, prove or disprove the vulnerability |
| omv-repro | `/omv-repro` | Guide local reproduction, fill evidence.observed_result |
| omv-report | `/omv-report` | Generate VulDB/CVE/GHSA/OSV advisory reports |

## Registry

Collection metadata lives in `references/registry.yaml`. Read it to show current version, platform requirements, and per-skill produces/consumes fields.

## State Directory

`.omv/` at the repository root stores findings, archive metadata, and the rebuildable local workspace index. It is private local research state and should be gitignored. Active findings live under `.omv/findings/`; inactive findings live under `.omv/archive/findings/`.

## CLI Delegation

When the user invokes workspace, lifecycle, repro scaffold, artifact check, archive, or restore commands, **run the matching `omv` CLI command via `Bash` and display its output. Do not implement the behavior manually** (do not `mkdir`, do not move files, do not write YAML directly).

Use `omv help`, `omv help review`, `omv help findings`, `omv help repro`, or `omv help report` as the source of truth for exact CLI signatures. For direct aliases:

- `/omv dashboard` -> `omv dashboard`
- `/omv status` -> `omv workspace status`
- `/omv log` -> `omv workspace log`
- `/omv next` -> `omv findings workflow`
- `/omv repro init ` -> `omv repro init `
- `/omv review ` -> `omv review `
- `/omv report artifacts ` -> `omv report artifacts `
- `/omv verification init ` -> `omv verification init `
- `/omv verification show ` -> `omv verification show `
- `/omv verification validate ` -> `omv verification validate `
- `/omv archive  --reason ` -> `omv findings archive  --reason `
- `/omv restore ` -> `omv findings restore `
- `/omv findings ...` -> `omv findings ...`

**If `omv` is not found on PATH**, output: "`omv` is not installed. Run: `npx oh-my-vul setup`"

### Subcommand reference

- **dashboard** — prints workspace status, active workflow queue, and recent activity in one view.
- **workspace status** — prints workspace path, active/archive counts, status counts, and privacy warnings.
- **workspace log** — prints the local activity trail for workspace init, finding init, promotion, archive, and restore.
- **init ``** — creates `.omv/findings/.yaml` from the Evidence.v1 template; default `--status candidate`. If file exists, CLI errors — suggest `--force`.
- **list** — prints ID / STATUS / READY / PACKAGE / VULNERABILITY table for every `.yaml` in `.omv/findings/`.
- **workflow** — prints active findings sorted by priority with NEXT ACTION recommendations such as `/omv-audit`, `/omv-repro`, `/omv-report`, promotion, or archive.
- **review ``** — runs the unified pre-report readiness review and returns one verdict: `ready`, `needs-repro`, `needs-audit`, `needs-verification`, or `blocked`. Use `--strict` when adversarial Verification.v1 must pass before reporting.
- **doctor ``** — advanced diagnostics for score deductions, unresolved blockers, suspicious CVSS/guard choices, sidecar validation, and artifact gaps. JSON mode is available for CI.
- **show ``** — prints one finding's package, vulnerability, validation errors/warnings, missing fields, and next action. Use `--archived` to inspect archived findings.
- **open ``** — prints the Evidence.v1 YAML path and next action so the user can edit or inspect the local file.
- **validate `[id|path]`** — checks required Evidence.v1 fields; exits non-zero on errors. No arg = validate whole ledger.
- **promote ` --status `** — updates the `status` field and re-validates. Valid statuses: `candidate`, `confirmed`, `blocked`.
- **repro init ``** — creates `.omv/repro//` with standard reproduction artifact files and records suggested `evidence.repro_artifacts`.
- **report artifacts ``** — checks `.omv/reports//` and Evidence.v1 reproduction artifact references before final archive.
- **verification init ``** — creates `.omv/verifications/.yaml` with the current Evidence.v1 SHA-256 for adversarial verifier review.
- **verification show ``** — summarizes Verification.v1 decision, disagreements, required changes, and stale-hash state.
- **verification validate ``** — validates Verification.v1 structure and warns when Evidence.v1 changed after review.
- **archive ` --reason `** — moves a finding to `.omv/archive/findings/` and removes it from active workflow views. For `--reason reported`, confirmed findings reuse `omv report artifacts ` checks; use `--strict` to block archive when artifacts are missing or empty.
- **archive list** — lists archived findings and archive reasons.
- **restore ``** — moves an archived finding back to `.omv/findings/`.

## Workflow Overview

```
/omv-find  →  identifies candidates
              writes .omv/findings/.yaml  (status: candidate)
                        ↓
/omv-audit →  deep-audits the finding: dataflow trace, guard verification,
              PoC description, CVSS scoring, dedup search
              updates .omv/findings/.yaml  (status: confirmed | blocked | candidate)
                        ↓
/omv-repro →  [optional] guides local reproduction when observed_result is unknown
              walks user through execution, records observed_result
              updates .omv/findings/.yaml  (status: confirmed | blocked)
                        ↓
/omv review → checks Evidence.v1 plus available ThreatMap.v1 / Verification.v1
              returns ready | needs-repro | needs-audit | needs-verification | blocked
                        ↓
/omv-report → reads confirmed finding, generates VulDB/CVE/GHSA/OSV report
                        ↓
archive    → omv findings archive  --reason reported
```

Each finding uses one of three Evidence.v1 statuses: `candidate`, `confirmed`, or `blocked`.
Use `omv dashboard`, `omv findings workflow`, or `/omv next` as the canonical active queue view after each stage. When the user asks whether a specific finding can be reported, run `omv review ` first and follow its verdict. When the CLI prints a priority value, follow the highest-priority row first unless the user names a specific finding.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [bx33661](https://github.com/bx33661)
- **Source:** [bx33661/oh-my-vul](https://github.com/bx33661/oh-my-vul)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-bx33661-oh-my-vul-omv
- Seller: https://agentstack.voostack.com/s/bx33661
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.