About

Imported from x-cmd/x-cmd (mod/osv/SKILL.md). Install upstream with npx skills add x-cmd/x-cmd --skill osv. Copyright stays with the author (Apache-2.0).

x osv - Open Source Vulnerabilities

Name: x-osv
Author: x-cmd

Query Google OSV database for package vulnerabilities and scan local projects.

Quick Start

# Query vulnerability for a package
x osv q -p jq -v 1.7.1

# Scan local project for vulnerabilities (requires osv-scanner)
x osv scanner .

Features

Vulnerability Query: Query OSV database for package vulnerabilities
Project Scanning: Scan local projects using osv-scanner
SARIF Reports: Generate SARIF security reports
Multi-ecosystem: Supports npm, pip, Maven, Go, Rust, etc.

Prerequisites

Tool	Purpose	Install
x-cmd	Required module runtime	`brew install x-cmd`
osv-scanner	Project scanning	https://github.com/google/osv-scanner

Commands

Command	Description
`x osv q <pkg>`	Query vulnerabilities for a package
`x osv scanner <path>`	Scan project for vulnerabilities (requires osv-scanner)
`x osv vuln <id>`	Get vulnerability details
`x osv sarif`	Generate SARIF security reports
`x osv eco`	List supported ecosystems

Examples

Query Vulnerabilities

# Query specific package version
x osv q -p jq -v 1.7.1

# Query by commit hash
x osv q -c 6879efc2c1596d11a6a6ad296f80063b558d5e0f

Scan Projects

# Scan current directory (requires osv-scanner installed)
x osv scanner .

# Scan specific lockfile
x osv scanner --lockfile requirements.txt
x osv scanner --lockfile package-lock.json

Generate SARIF Reports

# Scan npm project
x osv sarif npm ./my-project/

# Scan pip project with JSON output
x osv sarif pip ./project/ --json

Supported Ecosystems

View all supported ecosystems:

x osv eco

Includes: npm, PyPI, Maven, Go, Rust, NuGet, Packagist, etc.

API Key

No API key required for basic usage. Rate limits apply for unauthenticated requests.

{
  "ocm": "1",
  "id": "x-cmd-x-cmd-osv",
  "kind": "skill",
  "name": "x-osv",
  "description": "CLI for Google OSV database. Query vulnerabilities for packages, scan local projects for vulnerable dependencies. **Dependency**: This is an x-cmd module. Install x-cmd first (see x-cmd skill). **Required Tool**: Install osv-scanner for project scanning (see https://github.com/google/osv-scanner).",
  "publisher": "x-cmd",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "data_analysis"
    ],
    "tags": [
      "skill-md",
      "x-cmd",
      "security",
      "vulnerability",
      "osv",
      "scanner",
      "github"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "CLI for Google OSV database. Query vulnerabilities for packages, scan local projects for vulnerable dependencies. **Dependency**: This is an x-cmd module. Install x-cmd first (see x-cmd skill). **Required Tool**: Install osv-scanner for project scanning (see https://github.com/google/osv-scanner)."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github",
      "repository": "https://github.com/x-cmd/x-cmd",
      "path": "mod/osv/SKILL.md",
      "ref": "e18c1ef8b4695c7556c4e847b2eb7eaac13b9230",
      "url": "https://github.com/x-cmd/x-cmd/blob/e18c1ef8b4695c7556c4e847b2eb7eaac13b9230/mod/osv/SKILL.md",
      "key": "x-cmd/x-cmd/mod/osv/SKILL.md"
    },
    "compatibility": "POSIX Shell",
    "license": "Apache-2.0"
  },
  "instructions": "# x osv - Open Source Vulnerabilities\n\n> Query Google OSV database for package vulnerabilities and scan local projects.\n\n---\n\n## Quick Start\n\n```bash\n# Query vulnerability for a package\nx osv q -p jq -v 1.7.1\n\n# Scan local project for vulnerabilities (requires osv-scanner)\nx osv scanner .\n```\n\n---\n\n## Features\n\n- **Vulnerability Query**: Query OSV database for package vulnerabilities\n- **Project Scanning**: Scan local projects using osv-scanner\n- **SARIF Reports**: Generate SARIF security reports\n- **Multi-ecosystem**: Supports npm, pip, Maven, Go, Rust, etc.\n\n---\n\n## Prerequisites\n\n| Tool | P",
  "cost": {
    "context_tokens": 530
  }
}

Fetch it by URL: GET /api/v1/registry/x-cmd-x-cmd-osv/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.

x-osv