CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

track-findings

Track validated Codex Security findings in Linear, Jira, GitHub issues, or draft GitHub security advisories. Supports issue batches, duplicate checks, and reviewed writes. Do not use for scans or fixes.

68

Quality

86%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

92%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tightly written, high-stakes procedural skill: clear sequencing, pervasive validation gates and recovery loops, executable commands, and well-signaled references that exist in the bundle. The only weakness is minor redundancy in the pause/revalidation rules of section 5, which could be consolidated without losing clarity.

DimensionReasoningScore

Conciseness

The body is dense and operational with no explanations of concepts Claude already knows, assuming competence throughout. It falls short of score 5 because section 5's pause and revalidation rules overlap across three paragraphs and could be consolidated with modest trimming.

4 / 5

Actionability

Guidance is fully executable for an instruction-only skill: an exact validator invocation template, concrete commands ('gh --version', 'gh auth status --hostname <host>', 'GH_HOST=<host> gh repo view', 'gh issue create' with a mode-0600 temp file), and explicit outcome enums (create/reuse/update/blocked). The specific examples cover the common destination cases, matching the score-5 anchor.

5 / 5

Workflow Clarity

Five clearly sequenced stages with explicit validation checkpoints ('A nonzero exit stops tracking', refresh duplicates before each create, reconcile uncertain mutations before retry) and feedback loops (return to preview when source, audience, or destination changed). This batch-operations skill has thorough validation, so the missing-validation cap does not apply and it matches the score-5 anchor.

5 / 5

Progressive Disclosure

Provider-specific detail is correctly split into two real, one-level-deep bundle files, both clearly signaled at the point of need ('Read references/jira.md before Jira work and references/github-security-advisories.md before advisory work'), and those references point back to the main skill rather than nesting further. The core workflow kept inline is appropriately placed, matching the score-5 anchor.

5 / 5

Total

19

/

20

Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, distinctive description with concrete capabilities and named destinations, written in third person with a useful negative boundary. Its main weakness is the absence of a positive 'Use when...' trigger clause, which caps completeness, and limited synonym coverage for natural trigger phrases.

Suggestions

Add a positive trigger clause, e.g. 'Use when the user asks to file, track, or follow up on Codex Security findings in a tracker' — the current 'Do not use for scans or fixes' only excludes cases and leaves the 'when' implicit.

Broaden trigger-term coverage with natural synonyms such as 'tickets', 'vulnerabilities', or 'file issues' that users may say instead of 'track findings'.

Consider naming the approval-preview behavior ('shows the exact payload before writing') since 'reviewed writes' is terse and may not register as a trigger phrase.

DimensionReasoningScore

Specificity

The description lists multiple concrete capabilities ('issue batches, duplicate checks, and reviewed writes') and four named destinations (Linear, Jira, GitHub issues, draft GitHub security advisories), giving comprehensive coverage of the skill's actions. It exceeds the score-4 anchor because there are no meaningful gaps in the capability list for this niche.

5 / 5

Completeness

The 'what' is clear ('Track validated Codex Security findings in Linear, Jira, GitHub issues, or draft GitHub security advisories'), but there is no positive 'Use when...' clause; only the negative boundary 'Do not use for scans or fixes' is stated. Per the judging guidelines, a missing positive trigger clause caps completeness at 3; score 4 would require an explicit 'when' beyond a purely negative exclusion.

3 / 5

Trigger Term Quality

Natural terms users would say are present ('findings', 'Linear', 'Jira', 'GitHub issues', 'security advisories'), giving good keyword coverage. It falls short of score 5 because common synonyms and variations such as 'tickets', 'vulnerabilities', 'file an issue', or 'track bugs' are missing.

4 / 5

Distinctiveness Conflict Risk

The qualifier 'validated Codex Security findings' plus the four specific trackers carves out a clear niche with distinct triggers, and the explicit negative boundary ('Do not use for scans or fixes') further reduces conflict risk. It matches the score-5 anchor rather than 4 because overlap with generic issue-creation skills is minimal.

5 / 5

Total

17

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

relative_links

Relative link issues: 3 suspicious

Warning

Total

15

/

16

Passed

Repository

openai/plugins

Path

plugins/codex-security/skills/track-findings/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.