slimtoolkit/slim · error

invalid operation - %s

Error message

invalid operation - %s

What it means

The 'vulnerability epss' command validates its --op flag value when parsing CLI flags via EpssCommandFlagValues (pkg/app/master/command/vulnerability/cli.go:115). The op value must be exactly one of the accepted operations (EpssOpLookup or EpssOpList); anything else makes IsValidOp return false and the command returns "invalid operation - %s" before doing any work. This is an early, deliberate validation failure that stops the CLI with a bad-usage error.

Source

Thrown at pkg/app/master/command/vulnerability/cli.go:116

		return nil, err
	}

	values := &EpssCommandParams{
		CommonCommandParams:  common,
		Op:                   ctx.String(FlagOp),
		WithHistory:          ctx.Bool(FlagWithHistory),
		Limit:                ctx.Uint64(FlagLimit),
		Offset:               ctx.Uint64(FlagOffset),
		FilterCveIDPattern:   ctx.String(FlagFilterCveIDPattern),
		FilterDaysSinceAdded: ctx.Uint(FlagFilterDaysSinceAdded),
		FilterScoreGt:        ctx.Float64(FlagFilterScoreGt),
		FilterScoreLt:        ctx.Float64(FlagFilterScoreLt),
		FilterPercentileGt:   ctx.Float64(FlagFilterPercentileGt),
		FilterPercentileLt:   ctx.Float64(FlagFilterPercentileLt),
	}

	if !IsValidOp(values.Op) {
		return nil, fmt.Errorf("invalid operation - %s", values.Op)
	}

	if orderStr := ctx.String(FlagFilterOrderRecords); orderStr != "" {
		if !IsValidOrderRecordsValue(orderStr) {
			return nil, fmt.Errorf("invalid order records value - %s", orderStr)
		}

		values.FilterOrderRecords = OrderType(orderStr)
	}

	if dateStr := ctx.String(FlagDate); dateStr != "" {
		date, err := epss.DateFromString(dateStr)
		if err != nil {
			return nil, err
		}

		values.Date = date
	}

View on GitHub (pinned to 81940d17fa)

Solutions

1. Set --op to an accepted value: 'lookup' or 'list' (see EpssOpLookup/EpssOpList constants).
2. If --op was omitted, add it explicitly — the empty string fails IsValidOp.
3. Check 'slim vulnerability epss --help' for the currently supported op values, since names can change between versions.
4. If calling EpssCommandFlagValues programmatically, validate the ctx.String(FlagOp) value against vulnerability.IsValidOp before invoking it.

Example fix

// before
slim vulnerability epss --op=look
// after
slim vulnerability epss --op=lookup

const validOps = map[string]bool{"lookup": true, "list": true}
op := ctx.String("op")
if !validOps[op] {
    return fmt.Errorf("unsupported --op %q; use lookup or list", op)
}

func isValidOp(op string) bool {
    return op == "lookup" || op == "list"
}

params, err := vulnerability.EpssCommandFlagValues(ctx)
if err != nil {
    if strings.HasPrefix(err.Error(), "invalid operation") {
        fmt.Fprintf(os.Stderr, "usage: --op must be lookup|list (got: %v)\n", err)
        os.Exit(2)
    }
    return err
}

When it happens

Trigger: Running 'slim vulnerability epss' with a missing or misspelled --op flag value (e.g. --op=find, --op=look, or omitting --op entirely so it defaults to the empty string). Any value other than 'lookup' or 'list' triggers it.

Common situations: Typos or abbreviated op names on the command line; scripts written against an older CLI version whose op names changed; forgetting the --op flag in a wrapper script so Op is ""; IDE or docs showing outdated examples.

Related errors

• invalid order records value - %s
• malformed change data matcher: %s
• malformed change path matcher: %s
• malformed change data hash matcher: %s
• malformed find utf8: %s

AI-assisted analysis of slimtoolkit/slim@81940d17fa (2026-08-31). Data as JSON: /api/errors/f138f543c2a6ee54. Report an issue: GitHub.