Omv repro
Evidence-first vulnerability research workspace and Skills for Claude Code and Codex.
npx -y skills add bx33661/oh-my-vul --skill omv-reproAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Guides a researcher through local reproduction of a vulnerability finding. Use when the user has an omv-audit result with evidence.reproducer filled but evidence.observed_result still unknown, wants to confirm a finding by running it locally, or invokes `/omv-repro`. Reads .omv/findings/<id>.yaml and guides step-by-step execution, then writes the observed result, records repro artifacts, and validates submission readiness.
SKILL.md
4.7 KB, as published. Nobody here has run it
omv-repro
引导研究员在本地执行复现步骤，将 evidence.observed_result 从 unknown 填写为具体可验证的观测描述，完成 /omv-report 所需的最后一块证据。
Stay in passive research mode: do not execute any commands yourself. Guide the user to execute locally and report back what they observed.
Invocation
/omv-repro <id> [--force]
<id>对应.omv/findings/<id>.yaml文件--force允许覆盖已有observed_result（默认不覆盖）
Reference Loading
按需加载，不要一次性全读：
- 环境准备与观测记录框架：
references/repro-guide.md - Evidence.v1 字段定义与 evidence/submission 评分规则：
contracts/evidence.v1.yaml
复现目标
读取 .omv/findings/<id>.yaml 后，你的目标是：
终态条件（任一）
evidence.observed_result写入非unknown的具体观测描述，复现材料保存到.omv/repro/<id>/，且omv findings validate <id>输出 submission score ≥ 75- 无法复现，
blockers中记录具体原因，verdict.exploitability更新为blocked或disproven
如何达到目标，由你自主决定。 根据 evidence.reproducer 的内容——步骤数量、依赖环境、漏洞类型——自主决定如何拆解步骤、向用户提什么问题、如何解读输出。参考 references/repro-guide.md 获取环境准备和观测记录的思维框架。
开始前始终展示：versions.tested、evidence.source、evidence.sink、evidence.reproducer 的当前值，作为复现背景。
约束边界
以下是硬约束，不可逾越：
- 不自动执行命令 — 所有命令由用户在本地环境执行，Codex 或 Claude Code 只提供指令和解读
- 不修改
evidence.reproducer— 该字段属于 omv-audit 职责，只读 - 不推断或编造
observed_result— 必须来自用户的真实执行报告，不得根据 reproducer 文字推断结果 - 不攻击线上服务 — 所有执行在本地隔离环境中进行
- confirmed 由 CLI validation 决定 — 写入用户报告的
observed_result后，必须运行omv findings validate <id>；失败时保持candidate - 复现材料标准化保存 — 建议把命令、输出、截图或 Compose 文件放到
.omv/repro/<id>/，并在evidence.repro_artifacts中列出路径
HARD-GATE: observation before proven
NO invented observed_result
NO exploitability: proven WITHOUT user-reported local observation recorded in Evidence
NO "ready to submit" — after success, point to omv review --strict, not free-form certainty
结论规则
| 结论 | 触发条件 | 下一步 |
|---|---|---|
confirmed | observed_result 已填，submission score ≥ 75 | 运行 omv findings validate <id>，提示用户运行 /omv-report |
blocked | 多次尝试后无法在本地复现，或环境依赖无法满足 | 填写 blockers，运行 omv findings validate <id>（预期 FAIL） |
candidate（保留） | observed_result 已填但其他字段缺失或 submission score 不足 | 展示缺失项清单，提示回到 /omv-audit 补充 |
推荐 artifact 布局：
.omv/repro/<id>/
README.md
commands.sh
observed.txt
docker-compose.yml
screenshots/
evidence.reproducer 必须保持只读；如果用户发现步骤本身错误，提示回到 /omv-audit 修订，而不是在 /omv-repro 中改写。
复现结束时始终运行：
omv findings validate <id>
然后运行或建议：
omv dashboard
Use the CLI result for lifecycle handoff:
- If reproduction confirms the finding and validation returns OK, tell the user to run
/omv-report <id>. - If reproduction cannot continue and the finding is
blocked, tell the user to review blockers and optionally runomv findings archive <id> --reason not-reproducible. - If validation still fails because audit fields are missing, tell the user to return to
/omv-audit <id>.
Deterministic Helpers
omv findings validate <id>— 校验字段完整性，输出 evidence/submission 分数omv findings promote <id> --status confirmed|blocked— 更新 status 字段omv dashboard— 显示 active findings 的下一步动作