agentsclimarketplace
Sign in

Omv dedup

Skill bx33661/oh-my-vul/skills/omv-dedup

Checks whether an Evidence.v1 finding is likely already disclosed. Use when the user asks to deduplicate a finding, check CNA duplicate risk, search NVD/GHSA/OSV/ecosystem advisory databases, or invokes `/omv-dedup`. Produces deterministic advisory queries and writes Evidence.v1 dedup fields only after confirmation.From its SKILL.md

Install
npx -y skills add bx33661/oh-my-vul --skill omv-dedup

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • 3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
  • runs commandsInstructs the agent to run 2 commands, including `omv dedup <id>` and 1 more.

SKILL.md

2.0 KB, 392 tokens by cl100k_base, as published. Nobody here has run it

omv-dedup

Assess duplicate disclosure risk for a local finding.

Invocation

/omv-dedup <id>

Workflow

  1. Read .omv/findings/<id>.yaml using contracts/evidence.v1.yaml as the local schema reference.
  2. Run omv dedup <id> to produce deterministic NVD, GHSA, OSV, and ecosystem advisory queries.
  3. Show the queries before conclusions.
  4. Compare package, ecosystem, affected range, vulnerability class, CWE, source, sink, guard, and fixed version signals.
  5. Grade CNA duplicate risk as High, Medium, or Low.
  6. Only after user confirmation, write fields with:
    • omv dedup <id> --confirm --existing-cve <CVE|none> --notes <summary>

Risk Rules

  • High: same package plus same vulnerability class plus overlapping affected range or sink behavior.
  • Medium: same package or same sink behavior, but incomplete version or guard overlap.
  • Low: no close advisory match after source-specific searches.

Do not block a novel finding solely from package-name overlap.

Comparison Method

Build a table before assigning risk:

  • Query source: NVD, GHSA, OSV, ecosystem database, maintainer advisory.
  • Identity overlap: ecosystem, registry name, repository, vendor/product.
  • Version overlap: affected range, fixed version, release date, vulnerable component.
  • Behavior overlap: source type, sink API, guard/fix description, CWE, exploitability preconditions.
  • Provenance quality: primary advisory, maintainer fix, registry metadata, or secondary mention.

Use sanitized fixture names in examples and evals. Do not teach from a real public CVE as the default example; real CVEs are allowed only when supplied by the user or when validating identifier format.

What ships with it: 4 files

10.6 KB alongside SKILL.md, 1 of them executable

contracts/

evals/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.