원클릭으로 Manus에서 모든 스킬 실행

omv-radar

스타3

포크0

업데이트2026년 5월 6일 15:41

Provides passive watchlist intelligence for oh-my-vul. Use when the user asks what changed for watched packages, ecosystems, vulnerability classes, advisories, releases, or invokes `/omv-radar`. Reads `.omv/radar/watchlist.yaml`, uses only passive external sources or offline fixtures, and writes local radar events for later briefings.

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

Manus에서 실행

출처

bx33661

bx33661/oh-my-vul

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Manus에서 실행

omv-radar

Maintain passive intelligence for watched packages and vulnerability classes.

Invocation

/omv-radar refresh [--dry-run]
/omv-radar brief

Workflow

Read .omv/radar/watchlist.yaml.
For refresh, prefer the CLI:
- omv radar refresh --dry-run for fixture-backed offline validation.
- omv radar refresh for local event append.
For summaries, run omv radar brief.
Group output by ecosystem, package, and signal type: advisory, release, suspected fix, or watchlist snapshot.
After a successful manual refresh, offer a weekly Monday refresh reminder, but do not create it unless the user asks.

Signal Methodology

Use radar as a triage aid, not as proof of a vulnerability.

Advisory signal: compare ecosystem, package identity, affected range, vulnerability class, and referenced fix locations.
Release signal: look for security-relevant changelog language, dependency bumps, parser/validation changes, or guard hardening.
Suspected-fix signal: treat commit messages such as "validate", "sanitize", "allowlist", or "path check" as review prompts only.
Watchlist signal: record that a watched item was evaluated, even when no advisory-like signal appears.

Prioritize review when multiple independent signals point to the same component or guard. Lower priority when only a broad keyword matches.

Passive Boundary

Radar may read advisory databases, registries, and public repository metadata. It must not send requests to target runtime services, run PoCs, or probe package deployments.

Output

End with a concise brief:

new advisories or CVEs
new releases
suspected fix commits
audit candidates worth reviewing next

If the watchlist is missing, tell the user to create .omv/radar/watchlist.yaml and include a sanitized example. Do not present any real active vulnerability as a tutorial target.

이 저장소의 다른 Skills

같은 저장소

omv-report

bx33661/oh-my-vul

Generate a complete, ready-to-submit VulDB vulnerability report and CVE request. Covers all major package ecosystems: npm, pip, Go, Cargo (Rust), RubyGems, Maven, Gradle, NuGet, Composer (PHP), CocoaPods, Swift Package Manager, pub (Dart/Flutter), Hex (Elixir), CPAN (Perl), CRAN (R), LuaRocks. Use this skill whenever the user wants to submit a vulnerability to VulDB, request a CVE, write a security advisory, or document a security bug for disclosure. Trigger on phrases like submit to VulDB, request a CVE, write a CVE report, help me report this vuln, 提交 VulDB, 申请 CVE, 帮我报这个漏洞. Also trigger proactively when the user has just finished analysing a vulnerability in any package ecosystem and asks what to do next.

2026-07-113

omv-audit

bx33661/oh-my-vul

Deep-audits a candidate finding from an Evidence.v1 file. Use when the user has an omv-find result they want to investigate further, wants to prove or disprove a vulnerability, needs to fill Evidence.v1 fields for omv-report, or invokes `/omv-audit`. Reads .omv/findings/<id>.yaml and produces a confirmed or blocked finding with all required evidence fields populated.

2026-07-113

omv-critic

bx33661/oh-my-vul

Performs adversarial pre-submission review of an Evidence.v1 finding plus optional ThreatMap.v1 and Verification.v1 sidecars. Use before `/omv-report` when the user wants likely CNA rejection reasons, report argument quality review, or a reject_risk rating.

2026-07-113

omv-find

bx33661/oh-my-vul

Finds and ranks open-source packages worth auditing for passive CVE/VulDB research. Use when the user asks for vulnerability research targets, CVE hunting candidates, packages to audit, projects to fuzz, or `/omv-find`. Supports npm, Python, Go, Rust, Java, Ruby, PHP, C#, Swift, Dart, Elixir, Perl, R, and Lua, with strongest guidance for npm/Python/Go/Rust/Java/Ruby. Produces evidence-backed source -> sink -> guard notes, metadata, scoring, and local audit next steps without live exploitation.

2026-07-113

omv-repro

bx33661/oh-my-vul

Guides a researcher through local reproduction of a vulnerability finding. Use when the user has an omv-audit result with evidence.reproducer filled but evidence.observed_result still unknown, wants to confirm a finding by running it locally, or invokes `/omv-repro`. Reads .omv/findings/<id>.yaml and guides step-by-step execution, then writes the observed result, records repro artifacts, and validates submission readiness.

2026-07-113

omv

bx33661/oh-my-vul

oh-my-vul local-first vulnerability research project manager. Shows workspace status, next actions, installed omv-* skills, registry info, and delegates .omv findings lifecycle commands. Use when the user types /omv, asks what to do next, or manages local findings.

2026-07-113

name	omv-radar
description	Provides passive watchlist intelligence for oh-my-vul. Use when the user asks what changed for watched packages, ecosystems, vulnerability classes, advisories, releases, or invokes `/omv-radar`. Reads `.omv/radar/watchlist.yaml`, uses only passive external sources or offline fixtures, and writes local radar events for later briefings.

omv-radar

Maintain passive intelligence for watched packages and vulnerability classes.

Invocation

/omv-radar refresh [--dry-run]
/omv-radar brief

Workflow

Read .omv/radar/watchlist.yaml.
For refresh, prefer the CLI:
- omv radar refresh --dry-run for fixture-backed offline validation.
- omv radar refresh for local event append.
For summaries, run omv radar brief.
Group output by ecosystem, package, and signal type: advisory, release, suspected fix, or watchlist snapshot.
After a successful manual refresh, offer a weekly Monday refresh reminder, but do not create it unless the user asks.

Signal Methodology

Use radar as a triage aid, not as proof of a vulnerability.

Advisory signal: compare ecosystem, package identity, affected range, vulnerability class, and referenced fix locations.
Release signal: look for security-relevant changelog language, dependency bumps, parser/validation changes, or guard hardening.
Suspected-fix signal: treat commit messages such as "validate", "sanitize", "allowlist", or "path check" as review prompts only.
Watchlist signal: record that a watched item was evaluated, even when no advisory-like signal appears.

Prioritize review when multiple independent signals point to the same component or guard. Lower priority when only a broad keyword matches.

Passive Boundary

Radar may read advisory databases, registries, and public repository metadata. It must not send requests to target runtime services, run PoCs, or probe package deployments.

Output

End with a concise brief:

new advisories or CVEs
new releases
suspected fix commits
audit candidates worth reviewing next

If the watchlist is missing, tell the user to create .omv/radar/watchlist.yaml and include a sanitized example. Do not present any real active vulnerability as a tutorial target.