Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →CLI for Google OSV database. Query vulnerabilities for packages, scan local projects for vulnerable dependencies. **Dependency**: This is an x-cmd module. Install x-cmd first (see x-cmd skill). **Required Tool**: Install osv-scanner for project scanning (see https://github.com/google/osv-scanner).
.claude/skills/x-cmd-x-osv/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-01 | ✗→✓ | ▲ Improved | -41% | 0% |
| case-03 | ✗→✓ | ▲ Improved | -36% | 0% |
| case-06 | ✗→✓ | ▲ Improved | -27% | 0% |
| case-09 | ✗→✓ | ▲ Improved | -46% | 0% |
| case-13 | ✗→✓ | ▲ Improved | -23% | 0% |
> Query Google OSV database for package vulnerabilities and scan local projects.
bash# Query vulnerability for a package x osv q -p jq -v 1.7.1 # Scan local project for vulnerabilities (requires osv-scanner) x osv scanner .
| Tool | Purpose | Install | |------|---------|---------| | x-cmd | Required module runtime | brew install x-cmd | | osv-scanner | Project scanning | https://github.com/google/osv-scanner |
| Command | Description | |---------|-------------| | x osv q <pkg> | Query vulnerabilities for a package | | x osv scanner <path> | Scan project for vulnerabilities (requires osv-scanner) | | x osv vuln <id> | Get vulnerability details | | x osv sarif | Generate SARIF security reports | | x osv eco | List supported ecosystems |
bash# Query specific package version x osv q -p jq -v 1.7.1 # Query by commit hash x osv q -c 6879efc2c1596d11a6a6ad296f80063b558d5e0f
bash# Scan current directory (requires osv-scanner installed) x osv scanner . # Scan specific lockfile x osv scanner --lockfile requirements.txt x osv scanner --lockfile package-lock.json
bash# Scan npm project x osv sarif npm ./my-project/ # Scan pip project with JSON output x osv sarif pip ./project/ --json
View all supported ecosystems:
bashx osv eco
Includes: npm, PyPI, Maven, Go, Rust, NuGet, Packagist, etc.
No API key required for basic usage. Rate limits apply for unauthenticated requests.
| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-01 | fail→pass | 9,526 | 2,764 | -71% | 1 | 1 | 0% | 1,564 | 927 | -41% | 0 | 0 | — |
case-02 | pass→pass | 15,797 | 9,498 | -40% | 1 | 1 | 0% | 1,284 | 952 | -26% | 0 | 0 | — |
case-03 | fail→pass | 9,295 | 4,530 | -51% | 1 | 1 | 0% | 1,582 | 1,008 | -36% | 0 | 0 | — |
case-04 | pass→pass | 8,824 | 4,757 | -46% | 1 | 1 | 0% | 1,344 | 1,259 | -6% | 0 | 0 | — |
case-05 | pass→pass | 7,158 | 3,360 | -53% | 1 | 1 | 0% | 1,159 | 958 | -17% | 0 | 0 | — |
case-06 | fail→pass | 8,399 | 4,575 | -46% | 1 | 1 | 0% | 1,351 | 983 | -27% | 0 | 0 | — |
case-07 | pass→pass | 7,957 | 2,660 | -67% | 1 | 1 | 0% | 1,128 | 935 | -17% | 0 | 0 | — |
case-08 | pass→pass | 13,205 | 2,611 | -80% | 1 | 1 | 0% | 2,162 | 926 | -57% | 0 | 0 | — |
case-09 | fail→pass | 12,095 | 3,301 | -73% | 1 | 1 | 0% | 1,969 | 1,061 | -46% | 0 | 0 | — |
case-10 | pass→pass | 17,540 | 2,412 | -86% | 1 | 1 | 0% | 2,305 | 872 | -62% | 0 | 0 | — |
case-11 | pass→pass | 10,380 | 2,453 | -76% | 1 | 1 | 0% | 1,416 | 899 | -37% | 0 | 0 | — |
case-12 | pass→pass | 19,809 | 7,871 | -60% | 1 | 1 | 0% | 3,420 | 913 | -73% | 0 | 0 | — |
case-13 | fail→pass | 9,353 | 5,169 | -45% | 1 | 1 | 0% | 1,155 | 887 | -23% | 0 | 0 | — |
case-14 | pass→pass | 15,463 | 3,062 | -80% | 1 | 1 | 0% | 2,455 | 1,030 | -58% | 0 | 0 | — |
case-15 | pass→pass | 3,999 | 3,203 | -20% | 1 | 1 | 0% | 449 | 843 | +88% | 0 | 0 | — |
case-16 | pass→pass | 4,359 | 4,183 | -4% | 1 | 1 | 0% | 376 | 826 | +120% | 0 | 0 | — |
case-17 | pass→pass | 5,952 | 2,760 | -54% | 1 | 1 | 0% | 819 | 880 | +7% | 0 | 0 | — |
case-18 | fail→pass | 9,334 | 3,429 | -63% | 1 | 1 | 0% | 1,700 | 1,071 | -37% | 0 | 0 | — |
case-19 | pass→pass | 15,410 | 12,120 | -21% | 1 | 1 | 0% | 2,396 | 2,505 | +5% | 0 | 0 | — |
case-20 | pass→fail | 8,748 | 4,620 | -47% | 1 | 1 | 0% | 1,340 | 1,308 | -2% | 0 | 0 | — |
case-21 | pass→pass | 17,837 | 7,858 | -56% | 1 | 1 | 0% | 1,659 | 1,903 | +15% | 0 | 0 | — |
case-22 | pass→fail | 7,090 | 9,695 | +37% | 1 | 1 | 0% | 1,163 | 1,556 | +34% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +18 percentage points is the difference between those two pass rates over the 22 comparable cases. 2 cases got worse with the skill loaded, and they are included in that figure.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.