Execute qualquer Skill no Manus
com um clique

Execute qualquer Skill no Manus com um clique

omv-radar

Estrelas3

Forks0

Atualizado6 de maio de 2026 às 15:41

Provides passive watchlist intelligence for oh-my-vul. Use when the user asks what changed for watched packages, ecosystems, vulnerability classes, advisories, releases, or invokes `/omv-radar`. Reads `.omv/radar/watchlist.yaml`, uses only passive external sources or offline fixtures, and writes local radar events for later briefings.

Instalação

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Executar no Manus

Fonte

bx33661

bx33661/oh-my-vul

Abrir repositório GitHub Ver repositórios do creator

Download

Executar no Manus

Ocupações relacionadasSOC

Baseado na classificação ocupacional SOC

Analistas de segurança da informaçãoInformática e Matemática·SOC 15-1212

Explorador de arquivos

4 arquivos

SKILL.md

readonly

name	omv-radar
description	Provides passive watchlist intelligence for oh-my-vul. Use when the user asks what changed for watched packages, ecosystems, vulnerability classes, advisories, releases, or invokes `/omv-radar`. Reads `.omv/radar/watchlist.yaml`, uses only passive external sources or offline fixtures, and writes local radar events for later briefings.

omv-radar

Maintain passive intelligence for watched packages and vulnerability classes.

Invocation

/omv-radar refresh [--dry-run]
/omv-radar brief

Workflow

Read .omv/radar/watchlist.yaml.
For refresh, prefer the CLI:
- omv radar refresh --dry-run for fixture-backed offline validation.
- omv radar refresh for local event append.
For summaries, run omv radar brief.
Group output by ecosystem, package, and signal type: advisory, release, suspected fix, or watchlist snapshot.
After a successful manual refresh, offer a weekly Monday refresh reminder, but do not create it unless the user asks.

Signal Methodology

Use radar as a triage aid, not as proof of a vulnerability.

Advisory signal: compare ecosystem, package identity, affected range, vulnerability class, and referenced fix locations.
Release signal: look for security-relevant changelog language, dependency bumps, parser/validation changes, or guard hardening.
Suspected-fix signal: treat commit messages such as "validate", "sanitize", "allowlist", or "path check" as review prompts only.
Watchlist signal: record that a watched item was evaluated, even when no advisory-like signal appears.

Prioritize review when multiple independent signals point to the same component or guard. Lower priority when only a broad keyword matches.

Passive Boundary

Radar may read advisory databases, registries, and public repository metadata. It must not send requests to target runtime services, run PoCs, or probe package deployments.

Output

End with a concise brief:

new advisories or CVEs
new releases
suspected fix commits
audit candidates worth reviewing next

If the watchlist is missing, tell the user to create .omv/radar/watchlist.yaml and include a sanitized example. Do not present any real active vulnerability as a tutorial target.

Mais deste repositório

mesmo repositório

omv-report

bx33661/oh-my-vul

Generate a complete, ready-to-submit VulDB vulnerability report and CVE request. Covers all major package ecosystems: npm, pip, Go, Cargo (Rust), RubyGems, Maven, Gradle, NuGet, Composer (PHP), CocoaPods, Swift Package Manager, pub (Dart/Flutter), Hex (Elixir), CPAN (Perl), CRAN (R), LuaRocks. Use this skill whenever the user wants to submit a vulnerability to VulDB, request a CVE, write a security advisory, or document a security bug for disclosure. Trigger on phrases like submit to VulDB, request a CVE, write a CVE report, help me report this vuln, 提交 VulDB, 申请 CVE, 帮我报这个漏洞. Also trigger proactively when the user has just finished analysing a vulnerability in any package ecosystem and asks what to do next.

2026-07-113

omv-audit

bx33661/oh-my-vul

Deep-audits a candidate finding from an Evidence.v1 file. Use when the user has an omv-find result they want to investigate further, wants to prove or disprove a vulnerability, needs to fill Evidence.v1 fields for omv-report, or invokes `/omv-audit`. Reads .omv/findings/<id>.yaml and produces a confirmed or blocked finding with all required evidence fields populated.

2026-07-113

omv-critic

bx33661/oh-my-vul

Performs adversarial pre-submission review of an Evidence.v1 finding plus optional ThreatMap.v1 and Verification.v1 sidecars. Use before `/omv-report` when the user wants likely CNA rejection reasons, report argument quality review, or a reject_risk rating.

2026-07-113

omv-find

bx33661/oh-my-vul

Finds and ranks open-source packages worth auditing for passive CVE/VulDB research. Use when the user asks for vulnerability research targets, CVE hunting candidates, packages to audit, projects to fuzz, or `/omv-find`. Supports npm, Python, Go, Rust, Java, Ruby, PHP, C#, Swift, Dart, Elixir, Perl, R, and Lua, with strongest guidance for npm/Python/Go/Rust/Java/Ruby. Produces evidence-backed source -> sink -> guard notes, metadata, scoring, and local audit next steps without live exploitation.

2026-07-113

omv-repro

bx33661/oh-my-vul

Guides a researcher through local reproduction of a vulnerability finding. Use when the user has an omv-audit result with evidence.reproducer filled but evidence.observed_result still unknown, wants to confirm a finding by running it locally, or invokes `/omv-repro`. Reads .omv/findings/<id>.yaml and guides step-by-step execution, then writes the observed result, records repro artifacts, and validates submission readiness.

2026-07-113

omv

bx33661/oh-my-vul

oh-my-vul local-first vulnerability research project manager. Shows workspace status, next actions, installed omv-* skills, registry info, and delegates .omv findings lifecycle commands. Use when the user types /omv, asks what to do next, or manages local findings.

2026-07-113

name	omv-radar
description	Provides passive watchlist intelligence for oh-my-vul. Use when the user asks what changed for watched packages, ecosystems, vulnerability classes, advisories, releases, or invokes `/omv-radar`. Reads `.omv/radar/watchlist.yaml`, uses only passive external sources or offline fixtures, and writes local radar events for later briefings.

omv-radar

Maintain passive intelligence for watched packages and vulnerability classes.

Invocation

/omv-radar refresh [--dry-run]
/omv-radar brief

Workflow

Read .omv/radar/watchlist.yaml.
For refresh, prefer the CLI:
- omv radar refresh --dry-run for fixture-backed offline validation.
- omv radar refresh for local event append.
For summaries, run omv radar brief.
Group output by ecosystem, package, and signal type: advisory, release, suspected fix, or watchlist snapshot.
After a successful manual refresh, offer a weekly Monday refresh reminder, but do not create it unless the user asks.

Signal Methodology

Use radar as a triage aid, not as proof of a vulnerability.

Advisory signal: compare ecosystem, package identity, affected range, vulnerability class, and referenced fix locations.
Release signal: look for security-relevant changelog language, dependency bumps, parser/validation changes, or guard hardening.
Suspected-fix signal: treat commit messages such as "validate", "sanitize", "allowlist", or "path check" as review prompts only.
Watchlist signal: record that a watched item was evaluated, even when no advisory-like signal appears.

Prioritize review when multiple independent signals point to the same component or guard. Lower priority when only a broad keyword matches.

Passive Boundary

Radar may read advisory databases, registries, and public repository metadata. It must not send requests to target runtime services, run PoCs, or probe package deployments.

Output

End with a concise brief:

new advisories or CVEs
new releases
suspected fix commits
audit candidates worth reviewing next

If the watchlist is missing, tell the user to create .omv/radar/watchlist.yaml and include a sanitized example. Do not present any real active vulnerability as a tutorial target.