Omv critic

Skill bx33661/oh-my-vul/skills/omv-critic

Evidence-first vulnerability research workspace and Skills for Claude Code and Codex.

Install

npx -y skills add bx33661/oh-my-vul --skill omv-critic

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Performs adversarial pre-submission review of an Evidence.v1 finding plus optional ThreatMap.v1 and Verification.v1 sidecars. Use before `/omv-report` when the user wants likely CNA rejection reasons, report argument quality review, or a reject_risk rating.

SKILL.md

2.1 KB, as published. Nobody here has run it

omv-critic

Challenge the finding before report submission.

Invocation

/omv-critic <id>

Workflow

Read .omv/findings/<id>.yaml using contracts/evidence.v1.yaml as the local schema reference.
If present, read .omv/threatmaps/<id>.yaml using contracts/threat-map.v1.yaml as the local schema reference.
If present, read .omv/verifications/<id>.yaml using contracts/verification.v1.yaml as the local schema reference.
Run or inspect omv findings validate <id> and omv verification validate <id> when the sidecar exists.
Evaluate argument quality separately from structural validation.
Output reject_risk: low|medium|high.
For medium or high risk, list 3-5 likely CNA or maintainer rejection reasons and concrete strengthening actions.

Review Focus

novelty and duplicate risk
affected version proof
source -> sink -> guard clarity
local observed result quality
CVSS and impact overclaiming
disclosure readiness

If reject_risk: high, do not recommend /omv-report yet.

Rejection-Risk Method

Frame findings as argument-quality gaps:

Novelty: duplicate risk, same affected range, same fix, or unresolved CNA path.
Evidence chain: missing file:line source, sink, guard, transform, or ThreatMap edge.
Verification: failed, stale, or missing adversarial review when the user expects a high-confidence submission.
Reproducibility: no user-reported local observation or unclear tested version.
Severity: CVSS metric overclaim, missing preconditions, or unsupported impact claim.
Disclosure readiness: no contact plan, unclear vendor, or missing timeline.

Use generic, sanitized examples when explaining risk. Do not copy conclusions from a real vulnerability case unless the user supplied that finding as active research context.