How do I install the X Osv skill?

Run npx skillmds@latest add dvcrn/x-osv in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is X Osv safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with X Osv?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is X Osv free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

dvcrn (@dvcrn) published this skill. Their other Agent Skills are listed on their SkillMD profile.

X Osv by dvcrn — Agent Skill

Name: X Osv
Rating: 4.2 (5 reviews)
Author: dvcrn

X Osv

CLI for Google OSV database. Query vulnerabilities for packages, scan local projects for vulnerable dependencies. **Dependency**: This is an x-cmd module. Install x-cmd first (see x-cmd skill). **Required Tool**: Install osv-scanner for project scanning (see https://github.com/google/osv-scanner).

dvcrn Updated Sep 8, 2026 32 repo stars

File contents

x osv - Open Source Vulnerabilities

Query Google OSV database for package vulnerabilities and scan local projects.

Quick Start

# Query vulnerability for a package
x osv q -p jq -v 1.7.1

# Scan local project for vulnerabilities (requires osv-scanner)
x osv scanner .

Features

Vulnerability Query: Query OSV database for package vulnerabilities
Project Scanning: Scan local projects using osv-scanner
SARIF Reports: Generate SARIF security reports
Multi-ecosystem: Supports npm, pip, Maven, Go, Rust, etc.

Prerequisites

Tool	Purpose	Install
x-cmd	Required module runtime	`brew install x-cmd`
osv-scanner	Project scanning	https://github.com/google/osv-scanner

Commands

Command	Description
`x osv q <pkg>`	Query vulnerabilities for a package
`x osv scanner <path>`	Scan project for vulnerabilities (requires osv-scanner)
`x osv vuln <id>`	Get vulnerability details
`x osv sarif`	Generate SARIF security reports
`x osv eco`	List supported ecosystems

Examples

Query Vulnerabilities

# Query specific package version
x osv q -p jq -v 1.7.1

# Query by commit hash
x osv q -c 6879efc2c1596d11a6a6ad296f80063b558d5e0f

Scan Projects

# Scan current directory (requires osv-scanner installed)
x osv scanner .

# Scan specific lockfile
x osv scanner --lockfile requirements.txt
x osv scanner --lockfile package-lock.json

Generate SARIF Reports

# Scan npm project
x osv sarif npm ./my-project/

# Scan pip project with JSON output
x osv sarif pip ./project/ --json

Supported Ecosystems

View all supported ecosystems:

x osv eco

Includes: npm, PyPI, Maven, Go, Rust, NuGet, Packagist, etc.

API Key

No API key required for basic usage. Rate limits apply for unauthenticated requests.

OSV.dev - Official OSV website
osv-scanner - Required tool for project scanning

---name: x-osvdescription: CLI for Google OSV database. Query vulnerabilities for packages, scan local projects for vulnerable dependencies. **Dependency**: This is an x-cmd module. Install x-cmd first (see x-cmd skill). **Required Tool**: Install osv-scanner for project scanning (see https://github.com/google/osv-scanner).---# x osv - Open Source Vulnerabilities> Query Google OSV database for package vulnerabilities and scan local projects.---## Quick Start```bash# Query vulnerability for a packagex osv q -p jq -v 1.7.1# Scan local project for vulnerabilities (requires osv-scanner)x osv scanner .```---## Features- **Vulnerability Query**: Query OSV database for package vulnerabilities- **Project Scanning**: Scan local projects using osv-scanner- **SARIF Reports**: Generate SARIF security reports- **Multi-ecosystem**: Supports npm, pip, Maven, Go, Rust, etc.---## Prerequisites| Tool | Purpose | Install ||------|---------|---------|| x-cmd | Required module runtime | `brew install x-cmd` || osv-scanner | Project scanning | https://github.com/google/osv-scanner |---## Commands| Command | Description ||---------|-------------|| `x osv q <pkg>` | Query vulnerabilities for a package || `x osv scanner <path>` | Scan project for vulnerabilities (requires osv-scanner) || `x osv vuln <id>` | Get vulnerability details || `x osv sarif` | Generate SARIF security reports || `x osv eco` | List supported ecosystems |---## Examples### Query Vulnerabilities```bash# Query specific package versionx osv q -p jq -v 1.7.1# Query by commit hashx osv q -c 6879efc2c1596d11a6a6ad296f80063b558d5e0f```### Scan Projects```bash# Scan current directory (requires osv-scanner installed)x osv scanner .# Scan specific lockfilex osv scanner --lockfile requirements.txtx osv scanner --lockfile package-lock.json```### Generate SARIF Reports```bash# Scan npm projectx osv sarif npm ./my-project/# Scan pip project with JSON outputx osv sarif pip ./project/ --json```---## Supported EcosystemsView all supported ecosystems:```bashx osv eco```Includes: npm, PyPI, Maven, Go, Rust, NuGet, Packagist, etc.---## API KeyNo API key required for basic usage. Rate limits apply for unauthenticated requests.---## Related- [OSV.dev](https://osv.dev) - Official OSV website- [osv-scanner](https://github.com/google/osv-scanner) - Required tool for project scanning

Frequently asked questions