fix-finding

Use when the user explicitly asks to fix and verify a validated or plausible security finding. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/codex-security/skills/fix-finding/SKILL.md

Quality

Content

77%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a well-sequenced, actionable security-fix workflow with explicit verification gates and feedback loops. Its main weaknesses are some repetition of the ordered gates across sections and a dangling reference to a non-existent scan-artifacts file.

Suggestions

Consolidate the ordered verification gates into one authoritative list and reference it from the Objective, Workbench, and Hard Rules sections to reduce repetition.

Either create the referenced ../../references/scan-artifacts.md or drop the conditional reference so progressive disclosure has no dangling pointer.

Dimension	Reasoning	Score
Conciseness	The body is dense and assumes Claude's competence (no basic concept explanations), but the ordered verification gates are restated across the Objective, Workflow step 5, Workbench Verify stage, and Hard Rules, so it could be tightened without losing clarity.	2 / 3
Actionability	Provides concrete, specific instruction (exact outcome tokens fixed/no_change/blocked, named verification gates, an enumerated patch contract, and workbench record states) rather than vague direction, satisfying the executable-guidance bar for an instruction-only skill.	3 / 3
Workflow Clarity	A clear 6-step numbered sequence with explicit, bolded validation checkpoints and feedback loops (revise or return blocked), matching the score-3 anchor of sequenced steps with checkpoints and error recovery.	3 / 3
Progressive Disclosure	Sections are well-organized, but no bundle files exist and the body contains a conditional reference to ../../references/scan-artifacts.md that does not resolve to a real file, a mild organization defect that keeps it below the clean score-3 bar.	2 / 3
	Total	10 / 12 Passed

Description

75%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly states its purpose and trigger with an effective negative-scope guard that reduces conflict risk. It is slightly generic in its action list and positive keyword coverage, which keeps specificity and trigger-term quality at the middle band.

Suggestions

Add one or two more concrete actions (e.g., reproduce, patch, re-verify) to lift specificity toward the score-3 multi-action anchor.

Broaden natural positive trigger terms to include common phrasings like "vulnerability," "CVE," or "security bug" rather than relying on a negative scope list.

Dimension	Reasoning	Score
Specificity	Names the security-fix domain and the two concrete actions "fix and verify" a finding, but does not enumerate multiple distinct actions (e.g., triage, reproduce, patch, report) the way the score-3 anchor lists three or more specific actions.	2 / 3
Completeness	Explicitly answers both what ("fix and verify a validated or plausible security finding") and when ("Use when the user explicitly asks..."), so it sits at the score-3 anchor rather than the score-2 case where the trigger is only implied.	3 / 3
Trigger Term Quality	Includes some natural user phrasings ("fix and verify," "security finding"), but the keyword list is thin and leans on a negative-scope list ("PR, commit, branch, patch, or repository scans") rather than covering common positive variations like "vulnerability," "CVE," or "security bug."	2 / 3
Distinctiveness Conflict Risk	The negative-scope clause ("Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans") carves out a clear niche around a single validated/plausible finding and actively prevents overlap with broad scan skills.	3 / 3
	Total	10 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: openai/plugins
Path: plugins/codex-security/skills/fix-finding/SKILL.md
Commit: 11c74d6

Reviewed: 17 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.