Skill Codex
Investigate pcap/pcapng captures with Wireshark MCP to answer traffic, security, and network troubleshooting questions. Select bounded queries, verify packet evidence, and report what the capture can and cannot establish. Use the CLI skill when the user chooses direct tshark execution.
MCP server Claude CodeCodexCursor +2
A Model Context Protocol (MCP) server for Wireshark / tshark packet analysis. Runs locally from the wireshark-mcp Python package.
Skill Claude CodeCodex
Analyze pcap/pcapng files directly with tshark in a terminal when the user chooses CLI execution or MCP is unavailable. Build reproducible queries, preserve scan and field semantics, and keep raw output out of Agent context.
Agent Claude Code
CVSS v3.1 vector and score computation agent for oh-my-vul. Use during omv-audit and omv-report to derive a CVSS vector from a finding's evidence. Operates purely from provided impact fields and the cvss-builder reference — no network, no file access beyond the reference. Refuses to inflate severity and treats unknown…
Agent Claude Code
Source → sink → guard dataflow analysis agent for oh-my-vul. Use during omv-find and omv-audit to inspect 2-5 source files per candidate and build a concrete dataflow note with file:line references. Static analysis only — never executes code. Also writes the ThreatMap.v1 sidecar for confirmed findings.
Agent Claude Code
Duplicate advisory detection agent for oh-my-vul. Use during omv-report, omv-dedup, and omv-critic to search NVD, GitHub Security Advisories, and ecosystem-specific databases for existing CVEs/advisories before a report is written. Refuses to invent CVE IDs and marks unreachable searches as not-searched rather than…
Agent Claude Code
Adversarial guard/bypass assessment agent for oh-my-vul. Use after dataflow-tracer has identified a candidate source→sink chain to independently assess whether an existing guard actually prevents exploitation. Biased toward finding bypasses — only concedes "guard is effective" when bypass truly cannot be constructed.
Agent Claude Code
Platform-specific advisory rendering agent for oh-my-vul. Use during omv-report to render VulDB, GHSA, OSV JSON, or Markdown advisory formats from a confirmed Evidence.v1 object. Refuses to produce submission-ready output when submissionscore < 75 and refuses entirely for blocked findings.
Agent Claude Code
Adversarial verification agent for oh-my-vul. Use after dataflow-tracer and guard-checker have produced a candidate audit conclusion, to independently refute it. The default stance is skeptical — assume the conclusion is wrong and find evidence supporting that. Only concedes agreement when refutation genuinely fails.…
Agent Claude Code
Passive candidate discovery agent for oh-my-vul. Use proactively during omv-find to scan public GitHub search results and registry metadata for packages worth auditing. Reads public sources only — does not clone, run live exploit attempts, or execute code.
Skill Claude CodeCodex
Deep-audits a candidate finding from an Evidence.v1 file. Use when the user has an omv-find result they want to investigate further, wants to prove or disprove a vulnerability, needs to fill Evidence.v1 fields for omv-report, or invokes /omv-audit. Reads .omv/findings/ .yaml and produces a confirmed or blocked finding…
Skill Claude CodeCodex
Performs adversarial pre-submission review of an Evidence.v1 finding plus optional ThreatMap.v1 and Verification.v1 sidecars. Use before /omv-report when the user wants likely CNA rejection reasons, report argument quality review, a rejectrisk rating, or a recommendation of which researchergoal (VulDB, CVE, GHSA…
Skill Claude CodeCodex
Checks whether an Evidence.v1 finding is likely already disclosed. Use when the user asks to deduplicate a finding, check CNA duplicate risk, search NVD/GHSA/OSV/ecosystem advisory databases or public discussion (issues, PRs, commits, blogs), or invokes /omv-dedup. Produces deterministic queries, grades novelty risk…
Skill Claude CodeCodex
Helps prepare responsible disclosure communications and timelines from an Evidence.v1 finding. Use when the user asks to contact a vendor, create initial/follow-up/deadline disclosure email templates, plan a 90-day timeline, record disclosure fields, or invokes /omv-disclose.
Skill Claude CodeCodex
Finds and ranks open-source packages worth auditing for passive CVE/VulDB research. Use when the user asks for vulnerability research targets, CVE hunting candidates, packages to audit, projects to fuzz, or /omv-find. Supports npm, Python, Go, Rust, Java, Ruby, PHP, C#, Swift, Dart, Elixir, Perl, R, and Lua, with…
Skill Claude CodeCodex
Variant-driven diffusion hunting for oh-my-vul. Use when the user has a confirmed or publicly disclosed vulnerability pattern and wants to find the same bug class in sibling packages, forks, or downstream consumers; also when they ask for watchlist maintenance, radar brief, or /omv-radar. Reads seeds from findings and…
Skill Claude CodeCodex
Generate a complete, ready-to-submit VulDB vulnerability report and CVE request. Covers all major package ecosystems: npm, pip, Go, Cargo (Rust), RubyGems, Maven, Gradle, NuGet, Composer (PHP), CocoaPods, Swift Package Manager, pub (Dart/Flutter), Hex (Elixir), CPAN (Perl), CRAN (R), LuaRocks. Use this skill whenever…
Skill Claude CodeCodex
Guides a researcher through local reproduction of a vulnerability finding. Use when the user has an omv-audit result with evidence.reproducer filled but evidence.observedresult still unknown, wants to confirm a finding by running it locally, or invokes /omv-repro. Reads .omv/findings/ .yaml and guides step-by-step…
Skill Claude CodeCodex
Skill "omv" from bx33661/oh-my-vul, covering omv, commands, skills in this collection, registry and state directory.
Skill Claude CodeCodex
Bootstrap discipline for oh-my-vul research. Use at the start of any vulnerability research conversation, when the user asks to audit/find/report a package, dig for CVEs, or run omv skills — and before claiming a finding is confirmed, ready to submit, or “done”. Establishes mandatory process, hard gates, and…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: