Omv disclose

Skill bx33661/oh-my-vul/skills/omv-disclose

Evidence-first vulnerability research workspace and Skills for Claude Code and Codex.

Install

npx -y skills add bx33661/oh-my-vul --skill omv-disclose

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Helps prepare responsible disclosure communications and timelines from an Evidence.v1 finding. Use when the user asks to contact a vendor, create initial/follow-up/deadline disclosure email templates, plan a 90-day timeline, record disclosure fields, or invokes `/omv-disclose`.

SKILL.md

1.4 KB, as published. Nobody here has run it

omv-disclose

Prepare local responsible disclosure material after a finding is report-ready.

Invocation

/omv-disclose <id>
/omv-disclose timeline <id> [--days N]

Workflow

Read .omv/findings/<id>.yaml using contracts/evidence.v1.yaml as the local schema reference.
Identify vendor type: individual maintainer, company, foundation, or unknown.
Generate three templates: initial contact, follow-up, and disclosure deadline reminder.
Use omv disclose timeline <id> for 90-day milestones or --days N for a custom window.
Ask before writing Evidence.v1 disclosure fields.

Template Requirements

Include package name, affected versions, impact summary, reproduction summary, suggested coordination deadline, and contact metadata. Avoid exploit payload expansion beyond what the existing Evidence.v1 reproducer already states.

Local State

Submission bookkeeping belongs in .omv/submissions/<id>.yaml through omv submissions and follows contracts/submission.v1.yaml. Research notes belong in .omv/notes/<id>.md. Treat both as private local state until sanitized.