CLI for Google OSV database. Query vulnerabilities for packages, scan local projects for vulnerable dependencies. **Dependency**: This is an x-cmd module. Install x-cmd first (see x-cmd skill). **Required Tool**: Install osv-scanner for project scanning (see https://github.com/google/osv-scanner).
Follow the repository instructions for this skill and your agent. Review the files and dependencies before adding it to your workflow.
SkillHub CLI
skillhub install edwinjhlee/x-osvInspect the source and compatibility requirements, then follow its installation steps.
Give your agent the source link and ask it to inspect instructions and dependencies before explaining the installation steps.
Query Google OSV database for package vulnerabilities and scan local projects.
# Query vulnerability for a package
x osv q -p jq -v 1.7.1
# Scan local project for vulnerabilities (requires osv-scanner)
x osv scanner .
| Tool | Purpose | Install |
|---|---|---|
| x-cmd | Required module runtime | brew install x-cmd |
| osv-scanner | Project scanning | https://github.com/google/osv-scanner |
| Command | Description |
|---|---|
x osv q <pkg> |
Query vulnerabilities for a package |
x osv scanner <path> |
Scan project for vulnerabilities (requires osv-scanner) |
x osv vuln <id> |
Get vulnerability details |
x osv sarif |
Generate SARIF security reports |
x osv eco |
List supported ecosystems |
# Query specific package version
x osv q -p jq -v 1.7.1
# Query by commit hash
x osv q -c 6879efc2c1596d11a6a6ad296f80063b558d5e0f
# Scan current directory (requires osv-scanner installed)
x osv scanner .
# Scan specific lockfile
x osv scanner --lockfile requirements.txt
x osv scanner --lockfile package-lock.json
# Scan npm project
x osv sarif npm ./my-project/
# Scan pip project with JSON output
x osv sarif pip ./project/ --json
View all supported ecosystems:
x osv eco
Includes: npm, PyPI, Maven, Go, Rust, NuGet, Packagist, etc.
No API key required for basic usage. Rate limits apply for unauthenticated requests.
These signals come from indexed source analysis and may lag behind changes. Check the current source files.
# x osv - Open Source Vulnerabilities > Query Google OSV database for package vulnerabilities and scan local projects. --- ## Quick Start ```bash # Query vulnerability for a package x osv q -p jq -v 1.7.1 # Scan local project for vulnerabilities (requires osv-scanner) x osv scanner . ``` --- ## Features - **Vulnerability Query**: Query OSV database for package vulnerabilities - **Project Scanning**: Scan local projects using osv-scanner - **SARIF Reports**: Generate SARIF security reports - **Multi-ecosystem**: Supports npm, pip, Maven, Go, Rust, etc. --- ## Prerequisites | Tool | Purpose | Install | |------|---------|---------| | x-cmd | Required module runtime | `brew install x-cmd` | | osv-scanner | Project scanning | https://github.com/google/osv-scanner | --- ## Commands | Command | Description | |---------|-------------| | `x osv q <pkg>` | Query vulnerabilities for a package | | `x osv scanner <path>` | Scan project for vulnerabilities (requires osv-scanner) | | `x osv vuln <id>` | Get vulnerability details | | `x osv sarif` | Generate SARIF security reports | | `x osv eco` | List supported ecosystems | --- ## Examples ### Query Vulnerabilities ```bash # Query specific package version x osv q -p jq -v 1.7.1 # Query by commit hash x osv q -c 6879efc2c1596d11a6a6ad296f80063b558d5e0f ``` ### Scan Projects ```bash # Scan current directory (requires osv-scanner installed) x osv scanner . # Scan specific lockfile x osv scanner --lockfile requirements.txt x osv scanner --lockfile package-lock.json ``` ### Generate SARIF Reports ```bash # Scan npm project x osv sarif npm ./my-project/ # Scan pip project with JSON output x osv sarif pip ./project/ --json ``` --- ## Supported Ecosystems View all supported ecosystems: ```bash x osv eco ``` Includes: npm, PyPI, Maven, Go, Rust, NuGet, Packagist, etc. --- ## API Key No API key required for basic usage. Rate limits apply for unauthenticated requests. --- ## Related - [OSV.dev](https://osv...
Bambu Lab 3D printer control and automation. Activate when user mentions: printer status, 3D printing, slice, analyze model, generate 3D, AMS filament, print monitor, Bambu Lab, or any 3D printing task. Full pi...
Generative Engine Optimization (GEO) for AI search visibility. Optimize content to appear in ChatGPT, Perplexity, Claude, and Google AI Overviews. Use when optimizing websites, pages, or content for LLM discove...
Agents can sign plugins, rotate credentials without losing identity, and publicly attest to behavior.
Send and receive P2P messages using disposable numbers and PINs. No servers, no accounts. Use for human notifications, approval flows, and agent-to-agent communication.