bx33661/oh-my-vul

bx33661/oh-my-vul

Agent Claude Code

CVSS v3.1 vector and score computation agent for oh-my-vul. Use during omv-audit and omv-report to derive a CVSS vector from a finding's evidence. Operates purely from provided impact fields and the cvss-builder reference — no network, no file access beyond the reference. Refuses to inflate severity and treats unknown…

bx33661/oh-my-vul

Agent Claude Code

Source → sink → guard dataflow analysis agent for oh-my-vul. Use during omv-find and omv-audit to inspect 2-5 source files per candidate and build a concrete dataflow note with file:line references. Static analysis only — never executes code. Also writes the ThreatMap.v1 sidecar for confirmed findings.

bx33661/oh-my-vul

Agent Claude Code

Duplicate advisory detection agent for oh-my-vul. Use during omv-report, omv-dedup, and omv-critic to search NVD, GitHub Security Advisories, and ecosystem-specific databases for existing CVEs/advisories before a report is written. Refuses to invent CVE IDs and marks unreachable searches as not-searched rather than…

bx33661/oh-my-vul

Agent Claude Code

Adversarial guard/bypass assessment agent for oh-my-vul. Use after dataflow-tracer has identified a candidate source→sink chain to independently assess whether an existing guard actually prevents exploitation. Biased toward finding bypasses — only concedes "guard is effective" when bypass truly cannot be constructed.

bx33661/oh-my-vul

Agent Claude Code

Platform-specific advisory rendering agent for oh-my-vul. Use during omv-report to render VulDB, GHSA, OSV JSON, or Markdown advisory formats from a confirmed Evidence.v1 object. Refuses to produce submission-ready output when submissionscore < 75 and refuses entirely for blocked findings.

bx33661/oh-my-vul

Agent Claude Code

Adversarial verification agent for oh-my-vul. Use after dataflow-tracer and guard-checker have produced a candidate audit conclusion, to independently refute it. The default stance is skeptical — assume the conclusion is wrong and find evidence supporting that. Only concedes agreement when refutation genuinely fails.…

bx33661/oh-my-vul

Agent Claude Code

Passive candidate discovery agent for oh-my-vul. Use proactively during omv-find to scan public GitHub search results and registry metadata for packages worth auditing. Reads public sources only — does not clone, run live exploit attempts, or execute code.