Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add bx33661/oh-my-vul --skill omvgit clone --depth 1 https://github.com/bx33661/oh-my-vulWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bx33661/oh-my-vul/omv)<a href="https://agentmods.dev/skills/bx33661/oh-my-vul/omv"><img src="https://agentmods.dev/badge/skills/bx33661/oh-my-vul/omv/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bx33661/oh-my-vul/omv"><img src="https://agentmods.dev/badge/skills/bx33661/oh-my-vul/omv.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00079 | $0.03188 |
| Opus 5 | $0.00039 | $0.01594 |
| Sonnet 5 | $0.00016 | $0.00638 |
| Haiku 4.5 | $0.00008 | $0.00319 |
Grade A, and why
omv scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 164 lines — stays where its author put it; the contents beside it link to each section on GitHub.
omv
oh-my-vul local-first vulnerability research project manager for Pi, Codex, and Claude Code.
Invocation depends on the active platform: Pi uses /skill:omv [args], Codex uses $omv [args], and Claude Code uses /omv [args]. The command table below uses /omv as shorthand for the active platform's project-manager invocation.
Process first: For any vulnerability research session (find / audit / report / “what next”), apply using-omv discipline — evidence before claims, CLI gates before “confirmed” or “ready to submit”, prefer campaign + attack-surface cards before bulk hypotheses. Do not invent parallel workflows outside .omv/ + omv CLI.
Commands
/omv list — list all installed omv-* skills with one-line descriptions
/omv dashboard — show workspace, active workflow queue, and recent activity
/omv tui — open the interactive Ink research workspace in a real terminal
/omv start [flags] — initialize the private workspace and first campaign
/omv eval — run deterministic stable skill eval checks
/omv campaign — list local research campaigns
/omv campaign show <id> — show Campaign scope, lanes, and next action
/omv campaign surfaces propose <id> — propose attack-surface cards (开题)
/omv campaign surfaces show <id> — show proposed/selected surface cards
/omv campaign surfaces select <id> --cards <id,id>
— select which cards become seed hypotheses
/omv campaign seed <id> — create candidate Evidence hypotheses (selected cards or lanes)
/omv status — show local .omv workspace status (delegates to omv CLI)
/omv log — show local workspace activity log (delegates to omv CLI)
/omv next — show active findings and recommended next actions
/omv audit <id> — deep-audit a candidate finding (delegates to omv-audit skill)
/omv repro <id> — guide local reproduction of a finding (delegates to omv-repro skill)
/omv repro init <id> — create .omv/repro/<id>/ artifact scaffold
/omv review <id> — review report readiness and recommend the next step
/omv report artifacts <id> — check report and reproduction artifacts
/omv report provenance <id> — hash report inputs into a local provenance manifest
/omv sources init <id> — capture SourceRef.v1 from known Evidence source facts
/omv sources validate <id> — check SourceRef.v1 and Evidence hash freshness
/omv verification init <id> — create .omv/verifications/<id>.yaml adversarial review scaffold
/omv verification show <id> — show adversarial verification status
/omv verification validate <id>
— validate Verification.v1 and stale Evidence hash
/omv archive <id> --reason <reason>
— archive an inactive finding (delegates to omv CLI)
/omv restore <id> — restore an archived finding (delegates to omv CLI)
/omv findings list — list .omv/findings evidence files (delegates to omv CLI)
/omv findings show <id> — show one finding's validation state and next action
/omv findings init <id> — create a finding template (delegates to omv CLI)
/omv findings validate [id] — validate one or all findings (delegates to omv CLI)
/omv findings promote <id> — update finding status (delegates to omv CLI)
/omv help — show this help text
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 164 lines · 79 tokens per session scan A 16ddbf533522
omv is a skill published in the GitHub repository bx33661/oh-my-vul (4 stars, last pushed 21d ago), licensed MIT. It adds 79 tokens to every session and 3,188 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
azure-devops
Manage Azure DevOps projects, work items, repos, PRs, pipelines, wikis, test plans, security alerts, variable groups, environments/approvals, branch policies, and attachments. Use when user asks to: manage sprints, create/update work items, list repos, create PRs, run pipelines, search code, manage wiki pages, check…
atlassian
Manage Jira issues and Confluence wiki pages in Atlassian Cloud. Use when: (1) searching/creating/updating Jira issues with JQL, (2) searching/reading/creating Confluence pages with CQL, (3) managing Jira workflows, transitions, and comments, (4) browsing Confluence spaces and page hierarchies. Supports OAuth 2.1 via…
jira-workflow
Orchestrate Jira workflows end-to-end. Use when building stories with approvals, transitioning items through lifecycle states, or syncing task completion with Jira.
migration-tracker
Context for ongoing migration from old Portfolio Buddy app. Use when: fixing bugs, adding migrated features, checking feature parity, or understanding why certain code exists. Contains list of 40 features being migrated and known issues.
jira-safe
Implement SAFe methodology in Jira. Use when creating Epics, Features, Stories with proper hierarchy, acceptance criteria, and parent-child linking.
linear
Manages Linear issues, teams, and projects via CLI. Lists issues, creates tasks, views details, links issues, and runs GraphQL queries. Must use for "my Linear issues", "create Linear task", "link issues in Linear", "Linear API query", or any Linear project management request.