finding-discovery

Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/codex-security/skills/finding-discovery/SKILL.md

Quality

Content

65%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable commands and a precise output contract, and it points to clearly signaled one-level references. Its weaknesses are a repetitive, over-long checklist that hurts conciseness, and the absence of explicit validation feedback loops for batch review, which caps workflow clarity.

Suggestions

Consolidate the repetitive Discovery Checklist bullets that restate 'enumerate concrete implementations / keep separate candidates / do not collapse' into a few generalized rules with a short enumeration of the sink families, to improve conciseness.

Add an explicit validate→fix→retry checkpoint to the file-review workflow (e.g. re-validate after fixing a flagged control) so batch review has a feedback loop.

Move the long enumeration-heavy checklist into a dedicated reference file (e.g. references/discovery-checklist.md) and keep SKILL.md as a concise overview that links to it.

Dimension	Reasoning	Score
Conciseness	The content is domain-specific rather than explaining concepts Claude already knows, but the ~60-line Discovery Checklist is highly repetitive — many bullets restate "enumerate each concrete implementation, keep separate candidate instances, do not suppress/collapse" in near-duplicate form and could be tightened into a few generalized rules. It is above level 1 (no basic-concept padding) but below level 3 because significant tightening is possible.	2 / 3
Actionability	It provides copy-paste-ready commands with full arguments (the generate_rank_input.py invocations) and a precise, enumerated output-contract field list. It is above level 2 because the guidance is executable and specific rather than pseudocode or abstract.	3 / 3
Workflow Clarity	The Code Diff Workflow is sequenced (read reference → generate rank_input → copy to deep_review_input → deep-review) and has a stop-and-ask checkpoint for missing inputs, but there is no explicit validate→fix→retry feedback loop for the batch file-review process. Per the rubric, batch operations without validation feedback loops cap at 2; it is above level 1 because a real sequence exists.	2 / 3
Progressive Disclosure	References are clearly signaled and one level deep (e.g. ../../references/scan-artifacts.md, ../security-scan/references/scan-artifacts-and-ledger.md#scoped-deep-review), but the large monolithic Discovery Checklist is inline content that could be split into its own reference file. It is above level 1 (no deep nesting, references are signaled) but below level 3 because content that should be separate is inline.	2 / 3
	Total	9 / 12 Passed

Description

90%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it has an explicit 'Use when' trigger, a clear niche, and an explicit negative guard that limits conflict risk. Its only weakness is that it names one main action rather than enumerating several concrete capabilities.

Dimension	Reasoning	Score
Specificity	It names the security domain and one concrete action — "discover candidate security findings in a repository or code change" — plus a scope guard, but does not list multiple distinct concrete actions. It is above level 1 (vague) because a real action is named, but short of level 3 which requires several specific actions.	2 / 3
Completeness	It explicitly answers both 'what' (discover candidate security findings) and 'when' via an explicit "Use when Codex is already in the finding-discovery phase ... or the user explicitly asks" trigger clause. It is above level 2 because the trigger is explicit, not merely implied.	3 / 3
Trigger Term Quality	It covers natural terms a user would say — "security scan", "discover candidate security findings", "repository", "code change", and PR/commit/branch/patch — giving good keyword coverage. It is above level 2 because common variations are present rather than only a few.	3 / 3
Distinctiveness Conflict Risk	The explicit negative guard — "Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans" — gives it a clear niche and reduces conflict with adjacent scan skills. It is above level 2 because the guard actively prevents wrong-skill triggering.	3 / 3
	Total	11 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: openai/plugins
Path: plugins/codex-security/skills/finding-discovery/SKILL.md
Commit: 11c74d6

Reviewed: 17 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.