track-findings

Track validated Codex Security findings in Linear, Jira, GitHub issues, or draft GitHub security advisories. Use it for one finding or an explicitly selected batch of up to 25 findings tracked as Linear, Jira, or GitHub issues. Includes duplicate checks, exact previews, approval-gated writes, and readback. Do not use it for scans or fixes.

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

70%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A rigorous, safety-first workflow with excellent sequencing and validation and clean reference splitting, but the body is long and repetitive and its most executable detail lives in references with placeholder-templated commands. Tightening restated rules and inlining a concrete worked example would raise the lower dimensions.

Suggestions

Consolidate the Hard Rules section into cross-references to the Workflow rather than restating it; rules like single-finding-only advisories, one provider/destination per run, and readback-before-completion each appear 2-3 times and inflate tokens without adding safety.

Inline one complete worked example — a full `gh issue create` with a concrete title/body template and one advisory JSON skeleton — so key executable detail is not reachable only via references, moving actionability toward copy-paste ready.

Anchor the placeholder-templated commands with one concrete sample (a real host, owner/repo, and finding id) so the <host>/<owner>/<repo> patterns have an unambiguous reference instance.

Dimension	Reasoning	Score
Conciseness	Free of basic-concept filler and information-dense, but at ~220 lines it restates several constraints across the detailed Workflow and the Hard Rules summary (single-finding-only advisories, one provider/destination per run, and readback-before-completion each recur 2-3 times), so it could be tightened without losing safety.	2 / 3
Actionability	Names exact commands and mutations ("gh issue create", "gh api --hostname", "createJiraIssue/editJiraIssue/getJiraIssue", mode-0600 temp file) beyond pseudocode, but key executable detail (full advisory JSON body, full payload construction) is deferred to references and many commands are placeholder-templated ("<host>", "<owner>/<repo>", "<user-supplied-scan-dir>"), so it is not copy-paste ready.	2 / 3
Workflow Clarity	A clearly sequenced 7-step workflow with a dedicated "Recheck After Approval" step containing a 5-item checklist, explicit validation checkpoints (rerun validate_tracking_source.py, recheck transport, reverify paths, repeat duplicate search), and feedback loops ("If any result changed, stop and present a new preview") — abundant validation for a batch operation.	3 / 3
Progressive Disclosure	SKILL.md is an overview that defers provider-specific detail to one-level-deep, well-signaled references ("Read references/jira.md in full", "follow references/github-security-advisories.md in full"), both of which exist in the bundle; the helper script's plugin-root location is explicitly explained rather than dangled.	3 / 3
	Total	10 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that names concrete actions, includes explicit positive and negative trigger guidance, and carves out a clearly distinct niche. It answers both what the skill does and when to use it without padding or buzzwords.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — "Track validated Codex Security findings in Linear, Jira, GitHub issues, or draft GitHub security advisories" and "Includes duplicate checks, exact previews, approval-gated writes, and readback" — matching the score-3 anchor rather than a single domain label.	3 / 3
Completeness	States what (track findings into named trackers with duplicate checks, previews, approval-gated writes, readback) and an explicit when ("Use it for one finding or an explicitly selected batch of up to 25..." plus the negative trigger "Do not use it for scans or fixes"), satisfying the explicit-trigger requirement that would otherwise cap at 2.	3 / 3
Trigger Term Quality	Uses natural product terms a user would actually say — "Linear", "Jira", "GitHub issues", "GitHub security advisories", "findings" — giving good coverage rather than opaque jargon.	3 / 3
Distinctiveness Conflict Risk	Occupies a narrow niche (validated Codex Security findings into specific trackers) and adds an explicit exclusion ("Do not use it for scans or fixes"), making it unlikely to trigger for scan/fix or generic issue skills.	3 / 3
	Total	12 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 1 missing, 1 deeper-than-1-level, 3 suspicious	Warning
referenced_paths_exist	Referenced path issues: 1 missing	Warning

	Total	14 / 16 Passed

Repository: openai/plugins
Path: plugins/codex-security/skills/track-findings/SKILL.md
Commit: 11c74d6

Reviewed: 17 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.