registry / oh-my-vul / 1.0.0

oh-my-vul@1.0.0

Evidence-first vulnerability research skills for Codex and Claude Code

AI Security Review

scanned 18h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. An explicit setup command installs this package's skills and Claude agent definitions into user- or project-level agent discovery directories. No unconsented install-time mutation is present.

Static reason

No blocking static signals were detected.

Trigger

User runs `omv setup` with the selected scope/platform.

Impact

Installed instructions may be auto-discovered by Codex or Claude Code in later sessions.

Mechanism

Copies first-party skills and agent markdown into AI-agent extension paths.

Rationale

No concrete malware chain, credential exfiltration, or install-time execution was found. The explicit user-command agent-extension installation warrants a warning under the stated policy.

Evidence

package.jsondist/cli/omv.jsdist/cli/commands/setup.jsdist/cli/setup.jsdist/cli/paths.jsdist/cli/commands/index.jsdist/cli/request.jsagents/*.mdskills/*

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

oh-my-vul@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code