# Omv Disclose

> Helps prepare responsible disclosure communications and timelines from an Evidence.v1 finding. Use when the user asks to contact a vendor, create initial/follow-up/deadline disclosure email templates, plan a 90-day timeline, record disclosure fields, or invokes `/omv-disclose`.

- Skill: `bx33661/omv-disclose` (Agent Skill, multi-file: 6 files)
- Install (CLI): `npx skillmds@latest add bx33661/omv-disclose`
- Raw SKILL.md: https://api.skillmd.com/api/skills/bx33661/omv-disclose/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Productivity
- Author: bx33661 (https://skillmd.com/u/bx33661)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/bx33661/omv-disclose

---


# omv-disclose

Prepare local responsible disclosure material after a finding is report-ready.

## Invocation

```text
/omv-disclose <id>
/omv-disclose timeline <id> [--days N]
```

## Workflow

1. Read `.omv/findings/<id>.yaml` using `contracts/evidence.v1.yaml` as the local schema reference.
2. Identify vendor type: individual maintainer, company, foundation, or unknown.
3. Generate three templates: initial contact, follow-up, and disclosure deadline reminder.
4. Use `omv disclose timeline <id>` for 90-day milestones or `--days N` for a custom window.
5. Ask before writing Evidence.v1 disclosure fields.

## Template Requirements

Include package name, affected versions, impact summary, reproduction summary, suggested coordination deadline, and contact metadata. Avoid exploit payload expansion beyond what the existing Evidence.v1 reproducer already states.

## Local State

Submission bookkeeping belongs in `.omv/submissions/<id>.yaml` through `omv submissions` and follows `contracts/submission.v1.yaml`. Research notes belong in `.omv/notes/<id>.md`. Treat both as private local state until sanitized.