agentsclimarketplace
Sign in

Omv critic

Skill bx33661/oh-my-vul/skills/omv-critic

Performs adversarial pre-submission review of an Evidence.v1 finding plus optional ThreatMap.v1 and Verification.v1 sidecars. Use before `/omv-report` when the user wants likely CNA rejection reasons, report argument quality review, or a reject_risk rating.From its SKILL.md

Install
npx -y skills add bx33661/oh-my-vul --skill omv-critic

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • 3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
  • runs commandsInstructs the agent to run 2 commands, including `omv findings validate <id>` and 1 more.

SKILL.md

2.1 KB, 418 tokens by cl100k_base, as published. Nobody here has run it

omv-critic

Challenge the finding before report submission.

Invocation

/omv-critic <id>

Workflow

  1. Read .omv/findings/<id>.yaml using contracts/evidence.v1.yaml as the local schema reference.
  2. If present, read .omv/threatmaps/<id>.yaml using contracts/threat-map.v1.yaml as the local schema reference.
  3. If present, read .omv/verifications/<id>.yaml using contracts/verification.v1.yaml as the local schema reference.
  4. Run or inspect omv findings validate <id> and omv verification validate <id> when the sidecar exists.
  5. Evaluate argument quality separately from structural validation.
  6. Output reject_risk: low|medium|high.
  7. For medium or high risk, list 3-5 likely CNA or maintainer rejection reasons and concrete strengthening actions.

Review Focus

  • novelty and duplicate risk
  • affected version proof
  • source -> sink -> guard clarity
  • local observed result quality
  • CVSS and impact overclaiming
  • disclosure readiness

If reject_risk: high, do not recommend /omv-report yet.

Rejection-Risk Method

Frame findings as argument-quality gaps:

  • Novelty: duplicate risk, same affected range, same fix, or unresolved CNA path.
  • Evidence chain: missing file:line source, sink, guard, transform, or ThreatMap edge.
  • Verification: failed, stale, or missing adversarial review when the user expects a high-confidence submission.
  • Reproducibility: no user-reported local observation or unclear tested version.
  • Severity: CVSS metric overclaim, missing preconditions, or unsupported impact claim.
  • Disclosure readiness: no contact plan, unclear vendor, or missing timeline.

Use generic, sanitized examples when explaining risk. Do not copy conclusions from a real vulnerability case unless the user supplied that finding as active research context.

What ships with it: 6 files

14.1 KB alongside SKILL.md, 1 of them executable

contracts/

evals/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.