bx33661

@bx33661 source repo

12 skills
0 followers
15 hours ago last updated

▌
Omv · bx33661 bundle
oh-my-vul local-first vulnerability research project manager for Pi, Codex, and Claude Code. Shows workspace status, next actions, installed omv-* skills, registry info, and delegates .omv findings lifecycle commands. Use when the user invokes /skill:omv, $omv, or /omv; asks what to do next; or manages local findings.

0
installs
▌
Omv Find · bx33661 bundle
Finds and ranks open-source packages worth auditing for passive CVE/VulDB research. Use when the user asks for vulnerability research targets, CVE hunting candidates, packages to audit, projects to fuzz, or `/omv-find`. Supports npm, Python, Go, Rust, Java, Ruby, PHP, C#, Swift, Dart, Elixir, Perl, R, and Lua, with strongest guidance for npm/Python/Go/Rust/Java/Ruby. Produces evidence-backed source -> sink -> guard notes, metadata, scoring, and local audit next steps without live exploitation.

0
installs
▌
Omv Audit · bx33661 bundle
Deep-audits a candidate finding from an Evidence.v1 file. Use when the user has an omv-find result they want to investigate further, wants to prove or disprove a vulnerability, needs to fill Evidence.v1 fields for omv-report, or invokes `/omv-audit`. Reads .omv/findings/<id>.yaml and produces a confirmed or blocked finding with all required evidence fields populated.

0
installs
▌
Omv Dedup · bx33661 bundle
Checks whether an Evidence.v1 finding is likely already disclosed. Use when the user asks to deduplicate a finding, check CNA duplicate risk, search NVD/GHSA/OSV/ecosystem advisory databases or public discussion (issues, PRs, commits, blogs), or invokes `/omv-dedup`. Produces deterministic queries, grades novelty risk, and writes Evidence.v1 dedup fields only after confirmation.

0
installs
▌
Omv Radar · bx33661 bundle
Variant-driven diffusion hunting for oh-my-vul. Use when the user has a confirmed or publicly disclosed vulnerability pattern and wants to find the same bug class in sibling packages, forks, or downstream consumers; also when they ask for watchlist maintenance, radar brief, or `/omv-radar`. Reads seeds from findings and advisories, applies variant playbooks, and hands screened candidates to omv-audit.

0
installs
▌
Omv Repro · bx33661 bundle
Guides a researcher through local reproduction of a vulnerability finding. Use when the user has an omv-audit result with evidence.reproducer filled but evidence.observed_result still unknown, wants to confirm a finding by running it locally, or invokes `/omv-repro`. Reads .omv/findings/<id>.yaml and guides step-by-step execution, then writes the observed result, records repro artifacts, and validates submission readiness.

0
installs
▌
Using Omv · bx33661 bundle
Bootstrap discipline for oh-my-vul research. Use at the start of any vulnerability research conversation, when the user asks to audit/find/report a package, dig for CVEs, or run omv skills — and before claiming a finding is confirmed, ready to submit, or “done”. Establishes mandatory process, hard gates, and evidence-before-claims rules. Prefer this over improvising a research workflow.

0
installs
▌
Omv Critic · bx33661 bundle
Performs adversarial pre-submission review of an Evidence.v1 finding plus optional ThreatMap.v1 and Verification.v1 sidecars. Use before `/omv-report` when the user wants likely CNA rejection reasons, report argument quality review, a reject_risk rating, or a recommendation of which researcher_goal (VulDB, CVE, GHSA, advisory) fits the finding.

0
installs
▌
Omv Report · bx33661 bundle
Generate a complete, ready-to-submit VulDB vulnerability report and CVE request. Covers all major package ecosystems: npm, pip, Go, Cargo (Rust), RubyGems, Maven, Gradle, NuGet, Composer (PHP), CocoaPods, Swift Package Manager, pub (Dart/Flutter), Hex (Elixir), CPAN (Perl), CRAN (R), LuaRocks. Use this skill whenever the user wants to submit a vulnerability to VulDB, request a CVE, write a security advisory, or document a security bug for disclosure. Trigger on phrases like submit to VulDB, request a CVE, write a CVE report, help me report this vuln, 提交 VulDB, 申请 CVE, 帮我报这个漏洞. Also trigger proactively when the user has just finished analysing a vulnerability in any package ecosystem and asks what to do next.

0
installs
▌
Omv Disclose · bx33661 bundle
Helps prepare responsible disclosure communications and timelines from an Evidence.v1 finding. Use when the user asks to contact a vendor, create initial/follow-up/deadline disclosure email templates, plan a 90-day timeline, record disclosure fields, or invokes `/omv-disclose`.

0
installs
▌
Tshark CLI Analysis · bx33661 bundle
Analyze pcap/pcapng files directly with tshark in a terminal when the user chooses CLI execution or MCP is unavailable. Build reproducible queries, preserve scan and field semantics, and keep raw output out of Agent context.

1
install
▌
Wireshark Traffic Analysis · bx33661 bundle
Investigate pcap/pcapng captures with Wireshark MCP to answer traffic, security, and network troubleshooting questions. Select bounded queries, verify packet evidence, and report what the capture can and cannot establish. Use the CLI skill when the user chooses direct tshark execution.

1
install

12 published skills