Omv dedup

Skill bx33661/oh-my-vul/skills/omv-dedup

Evidence-first vulnerability research workspace and Skills for Claude Code and Codex.

Install

npx -y skills add bx33661/oh-my-vul --skill omv-dedup

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Checks whether an Evidence.v1 finding is likely already disclosed. Use when the user asks to deduplicate a finding, check CNA duplicate risk, search NVD/GHSA/OSV/ecosystem advisory databases, or invokes `/omv-dedup`. Produces deterministic advisory queries and writes Evidence.v1 dedup fields only after confirmation.

SKILL.md

2.0 KB, as published. Nobody here has run it

omv-dedup

Assess duplicate disclosure risk for a local finding.

Invocation

/omv-dedup <id>

Workflow

Read .omv/findings/<id>.yaml using contracts/evidence.v1.yaml as the local schema reference.
Run omv dedup <id> to produce deterministic NVD, GHSA, OSV, and ecosystem advisory queries.
Show the queries before conclusions.
Compare package, ecosystem, affected range, vulnerability class, CWE, source, sink, guard, and fixed version signals.
Grade CNA duplicate risk as High, Medium, or Low.
Only after user confirmation, write fields with:
- omv dedup <id> --confirm --existing-cve <CVE|none> --notes <summary>

Risk Rules

High: same package plus same vulnerability class plus overlapping affected range or sink behavior.
Medium: same package or same sink behavior, but incomplete version or guard overlap.
Low: no close advisory match after source-specific searches.

Do not block a novel finding solely from package-name overlap.

Comparison Method

Build a table before assigning risk:

Query source: NVD, GHSA, OSV, ecosystem database, maintainer advisory.
Identity overlap: ecosystem, registry name, repository, vendor/product.
Version overlap: affected range, fixed version, release date, vulnerable component.
Behavior overlap: source type, sink API, guard/fix description, CWE, exploitability preconditions.
Provenance quality: primary advisory, maintainer fix, registry metadata, or secondary mention.

Use sanitized fixture names in examples and evals. Do not teach from a real public CVE as the default example; real CVEs are allowed only when supplied by the user or when validating identifier format.