finding-discovery

Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/codex-security/skills/finding-discovery/SKILL.md

Quality

Content

67%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured, actionable instruction-only skill with clear workflows and one-level-deep references, scoring well on actionability, workflow clarity, and progressive disclosure. Its weakest dimension is conciseness, due to heavy repetition of the same enumeration/non-collapse heuristic across many bullet points.

Suggestions

Consolidate the repeated 'enumerate concrete implementations, keep separate candidate instances, do not collapse or suppress' guidance into one stated principle, then list the affected families (SQL, SSRF, XML/deserialization, auth, archive, path traversal) compactly rather than restating the rule ~15 times.

Define the placeholder values (<python_command>, <plugin_dir>, <discovery_dir>, <repo_root>, <base>, <head>) once up front so the workflow commands become copy-paste ready.

Clarify upfront which workflow applies when (compact inventory present vs. targeted diff vs. standalone repository request) so the reader can pick a branch without reading all three sections.

Dimension	Reasoning	Score
Conciseness	The content is specialized security guidance rather than basics Claude already knows, but the Discovery Checklist restates one principle ("enumerate concrete implementations, keep each as a separate candidate, do not collapse or suppress") across ~15 bullets for different families, which could be consolidated and tightened.	3 / 5
Actionability	It provides concrete commands and tool names (e.g. generate_rank_input.py with specific flags, record_codex_security_discovery_candidates) plus a detailed output contract, but commands are parameterized with placeholders like <python_command> and <plugin_dir>, short of copy-paste ready.	4 / 5
Workflow Clarity	The Code Diff Workflow is a clear sequenced procedure with concrete per-step commands and an input-missing checkpoint; because discovery is read-only analysis rather than a destructive/batch mutation, the lack of a validate-fix-retry loop is not a disqualifying gap.	4 / 5
Progressive Disclosure	Sections are well organized and references to scan-artifacts.md, security-guidance.md, and severity-policy.md are clearly signaled and one level deep, though the large inlined checklist and references pointing into sibling skills rather than a local bundle leave minor organization gaps.	4 / 5
	Total	15 / 20 Passed

Description

82%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly and explicitly states both what the skill does and when to use it, with strong distinctiveness via explicit negative-trigger guidance. Its main weakness is specificity, naming essentially one capability rather than a list of concrete actions.

Dimension	Reasoning	Score
Specificity	It names the domain and one concrete action ("discover candidate security findings in a repository or code change") but does not enumerate multiple distinct capabilities, fitting the 1-2 concrete actions anchor rather than the several-actions anchor at 4.	3 / 5
Completeness	It explicitly answers both what ("discover candidate security findings") and when ("Use when Codex is already in the finding-discovery phase ... or the user explicitly asks"), with concrete trigger phrases matching the top anchor.	5 / 5
Trigger Term Quality	It includes natural terms a security user would say ("security scan", "discover candidate security findings", "repository", "code change") plus synonyms for code changes ("PR, commit, branch, patch"), with only minor gaps versus the comprehensive-synonym anchor at 5.	4 / 5
Distinctiveness Conflict Risk	It carves a clear niche (the finding-discovery phase) and adds an explicit negative-trigger clause ("Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans"), actively minimizing conflict with sibling skills.	5 / 5
	Total	17 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: openai/plugins
Path: plugins/codex-security/skills/finding-discovery/SKILL.md
Commit: 1e28582

Reviewed: 8 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.