bx33661/oh-my-vul/using-omv

using-omv

High-quality growth rule for this project: deepen discipline, do not inflate skill count.

This skill is the session bootstrap. Domain work still lives in the omv-find, omv-audit, omv-repro, and omv-report skills. You use those skills inside the process below — you do not invent parallel workflows.

Platform Invocation

Use the invocation form provided by the active agent:

In the workflow below, /omv-* is shorthand for the matching focused skill on the active platform.

Iron Laws

1. EVIDENCE BEFORE CLAIMS
2. CLI TRUTH BEFORE PROSE
3. PROCESS BEFORE IMPROVISATION
4. PASSIVE RESEARCH ONLY

<HARD-GATE> Before any research claim or lifecycle transition, you must satisfy the matching gate. Rationalizing past a gate is a failure mode, not speed. </HARD-GATE>

When This Applies

Invoke before substantive research action if the user is:

• looking for packages to audit, ranking targets, or running /omv-find
• auditing source → sink → guard, or running /omv-audit
• reproducing, reporting, disclosing, or asking “what next”
• about to say a finding is confirmed, report-ready, non-duplicate, or complete

If you are a subagent doing one delegated slice (e.g. only CVSS math), stay in that slice and still refuse to invent evidence.

Default Research Pipeline

Use this order unless the user already has a later-stage artifact and explicitly continues from it:

1. Orient
   omv dashboard  OR  /omv next
   If no campaign and user has a target → omv start / campaign init
 
2. Open the problem (开题) — prefer Attack Surface Cards when a campaign exists
   omv campaign surfaces propose <id>
   omv campaign surfaces select <id> --cards <id,id>
   omv campaign seed <id>
   (If no surfaces file, seed uses generic lanes — still candidate-only.)
 
3. Deepen one hypothesis at a time
   /omv-audit <id>     → fill Evidence; never invent file:line
   /omv-repro <id>     → only when observed_result is the blocker
   omv findings validate <id> after material edits
 
4. Gate before report language
   omv review <id> --strict
   Optional: /omv-critic <id>, /omv-dedup <id>
 
5. Report only when ready
   /omv-report <id> only if review says ready (or user overrides with explicit draft-only ask)
   Then provenance / archive only if user wants lifecycle bookkeeping

Announce briefly when you switch stages, e.g. “Using attack-surface cards to open the campaign” or “Running omv review --strict before any submit language.”

Hard Gates (non-negotiable)

Forbidden shortcuts

• Do not write submission-ready VulDB/GHSA/OSV prose for blocked or low-score candidate findings.
• Do not treat sink presence alone as a vulnerability.
• Do not attack live third-party services or auto-run exploit payloads.
• Do not create ThreatMap/Verification/report artifacts as fake proof during seed.
• Do not skip CLI validation by “manually eyeballing” YAML when omv is available.

Red Flags (stop and correct)

Skill Priority

When multiple omv skills apply:

1. Process — this skill (using-omv), /omv next, campaign/surfaces
2. Depth — find → audit → repro
3. Gate — review / critic / dedup
4. Output — report / disclose

Do not jump to report because the user said “CVE” if Evidence is incomplete — run the gate and show the gap.

Quality Over Sprawl

Prefer:

• tighter HARD-GATEs and CLI checks
• better Attack Surface catalog and Evidence fields
• adversarial verification when stakes are high

Avoid:

• new /omv-* skills for every idea
• parallel prose workflows that bypass .omv/
• automating confirmation without observation

Minimal CLI Cheatsheet

omv dashboard
omv start --target <name> --ecosystem <eco> --vuln <classes> --no-interactive
omv campaign surfaces propose <id>
omv campaign surfaces select <id> --cards <id,id>
omv campaign seed <id>
omv findings validate <id>
omv review <id> --strict

If omv is missing: install it with npm install --global oh-my-vul. Pi already manages the Skills installed by pi install npm:oh-my-vul, so Pi users should continue with omv version or omv start and must not run omv setup. In Codex or Claude Code, run the matching omv setup --platform codex|claude-code command and re-check with omv doctor --platform ....