CtrlK
BlogDocsLog inGet started
Tessl Logo

triage-finding

Use when the user supplies or imports existing security findings, vulnerability reports, or security/vulnerability Jira/Linear tickets from scanners, advisories, GitHub, Atlassian Rovo, Linear, or similar backlog sources and wants static repo-impact triage. Do not use for discovery, duplicate-bug triage, validation, or fixes.

63

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./plugins/codex-security/skills/triage-finding/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

73%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a thorough, well-structured triage procedure with explicit validation gates, feedback loops, and checklists, and it pushes detail into three real reference files. Its main weaknesses are redundancy of the verdict/boundary criteria across several sections and load-bearing references to external files that are not present in the skill bundle.

Suggestions

Consolidate the repeated confirmed/not_actionable boundary-and-reachability criteria into one authoritative section and have other sections reference it, to reduce token cost and drift risk.

Make the load-bearing external references resolvable — either ship ../../references/static-finding-assessment.md and ../../references/security-guidance.md (or ../../schemas/findings.schema.json) within the skill, or inline the essential bits they gate on.

Add the common trigger terms (CVE, SARIF, Dependabot, bug bounty) to the description's source list so the 'when' covers what users most often say.

DimensionReasoningScore

Conciseness

The body is dense with genuinely necessary procedural detail and avoids explaining basic concepts, but the confirmation/defeat criteria (reachability + supported boundary crossing; not_actionable defeating conditions) are restated across 'SECURITY.md Guidance Gate', 'Surface and Boundary Gate', 'Verdict Rules', and 'Hard Rules', so it could be tightened by consolidating.

3 / 5

Actionability

It gives concrete, executable guidance — exact verdict values, source_type enum, JSON contract field names, and pointers to reference files with real REST endpoints — with only minor gaps, and the absence of inline code is appropriate for an instruction-only skill.

4 / 5

Workflow Clarity

The 13-step Workflow is clearly sequenced with explicit validation gates that halt on failure ('Do not inspect the repository... unless ticket content was retrieved successfully', 'If no GitHub finding source is specified... ask... and stop'), plus feedback loops (retry-once-then-stop in ticket-intake) and checklists (Verdict Rules, Hard Rules), satisfying the batch-operation validation requirement.

5 / 5

Progressive Disclosure

SKILL.md is a well-organized overview with clearly signaled one-level-deep references to real bundle files (triage-result-contract.md, ticket-intake.md, github-rest-intake.md), but three load-bearing external references (../../schemas/findings.schema.json, ../../references/static-finding-assessment.md, ../../references/security-guidance.md) do not resolve within the skill's own bundle, slightly weakening navigation/verifiability.

4 / 5

Total

16

/

20

Passed

Description

73%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is highly specific and well-guarded, with explicit 'Use when' triggers and a 'Do not use for...' exclusion clause that sharply distinguishes it from adjacent skills. It is slightly let down by a terse 'what' that omits the verdict/ranking output and by a few missing common trigger terms.

DimensionReasoningScore

Specificity

The description names the domain and one concrete action — 'static repo-impact triage' — plus intake of findings, but it stops at 1-2 actions and omits the verdict/rank/output mechanics that the body covers, so it is not comprehensive.

3 / 5

Completeness

It has both an explicit 'when' ('Use when the user supplies or imports existing security findings...') and an explicit 'what' ('wants static repo-impact triage') plus a negative trigger ('Do not use for discovery, duplicate-bug triage, validation, or fixes'), but the 'what' is terse and does not state the verdict/ranking output, so it falls just short of the fully concrete 5-anchor.

4 / 5

Trigger Term Quality

Strong, natural keyword coverage ('security findings, vulnerability reports, security/vulnerability Jira/Linear tickets, scanners, advisories, GitHub, Atlassian Rovo, Linear, backlog sources') with synonyms and product names; a few common terms a user would say (CVE, SARIF, Dependabot, bug bounty) are absent, keeping it just below comprehensive.

4 / 5

Distinctiveness Conflict Risk

It carves a clear niche — static repo-impact triage of existing findings — and explicitly distinguishes it from sibling workflows ('Do not use for discovery, duplicate-bug triage, validation, or fixes'), giving minimal conflict risk.

5 / 5

Total

16

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
openai/plugins
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.