Evidence-first vulnerability research workspace and Skills for Claude Code and Codex.
Agent
CVSS v3.1 vector and score computation agent for oh-my-vul. Use during omv-audit and omv-report to derive a CVSS vector from a finding's evidence. Operates purely from provided impact fields and the cvss-builder reference — no network, no file access beyond the reference. Refuses to inflate severity and treats unknown…
Agent
Source → sink → guard dataflow analysis agent for oh-my-vul. Use during omv-find and omv-audit to inspect 2-5 source files per candidate and build a concrete dataflow note with file:line references. Static analysis only — never executes code. Also writes the ThreatMap.v1 sidecar for confirmed findings.
Agent
Duplicate advisory detection agent for oh-my-vul. Use during omv-report, omv-dedup, and omv-critic to search NVD, GitHub Security Advisories, and ecosystem-specific databases for existing CVEs/advisories before a report is written. Refuses to invent CVE IDs and marks unreachable searches as not-searched rather than…
Agent
Adversarial guard/bypass assessment agent for oh-my-vul. Use after dataflow-tracer has identified a candidate source→sink chain to independently assess whether an existing guard actually prevents exploitation. Biased toward finding bypasses — only concedes "guard is effective" when bypass truly cannot be constructed.
Agent
Platform-specific advisory rendering agent for oh-my-vul. Use during omv-report to render VulDB, GHSA, OSV JSON, or Markdown advisory formats from a confirmed Evidence.v1 object. Refuses to produce submission-ready output when submissionscore < 75 and refuses entirely for blocked findings.
Agent
Adversarial verification agent for oh-my-vul. Use after dataflow-tracer and guard-checker have produced a candidate audit conclusion, to independently refute it. The default stance is skeptical — assume the conclusion is wrong and find evidence supporting that. Only concedes agreement when refutation genuinely fails.…
Agent
Passive candidate discovery agent for oh-my-vul. Use proactively during omv-find to scan public GitHub search results and registry metadata for packages worth auditing. Reads public sources only — does not clone, run live exploit attempts, or execute code.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: