validation

Use when Codex is already in the validation phase of a security scan or the user explicitly asks to determine whether one or more candidate security findings are valid. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/codex-security/skills/validation/SKILL.md

Quality

Content

85%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with a clear sequenced workflow, concrete commands, and good progressive disclosure that externalizes detail to a real reference file; its main weakness is length and redundancy in the Hard Rules section.

Suggestions

Consolidate the overlapping Hard Rules on proportionate effort, artifact-path saving, and long-running-command handling into single rules to reduce redundancy.

Consider moving the repository-wide/scoped-path-specific hard rules into the validation-guidance reference to keep the core SKILL.md leaner.

Dimension	Reasoning	Score
Conciseness	The body is mostly procedural with no basic-concept padding, but the Hard Rules section is long and several rules overlap (proportionate-effort, save-to-path, and long-running-command guidance recur), so it could be tightened.	2 / 3
Actionability	It gives concrete executable guidance — exact debugger flags ('gdb: "-q -batch -ex run -ex bt -ex quit"'), an ordered validation-method menu, and a concrete output contract with a fixed disposition enum — matching the copy-paste-ready anchor.	3 / 3
Workflow Clarity	A clear 10-step workflow includes explicit checkpoints (step 7 documents proof gaps, step 8 returns an evidence-grounded assessment), a rubric checklist in the output contract, and failure-handling rules for builds and long-running commands.	3 / 3
Progressive Disclosure	SKILL.md is a well-sectioned overview pointing one level deep to a real bundle file (references/validation-guidance.md) plus shared ../../references files; the detailed validation rules are appropriately externalized rather than inlined.	3 / 3
	Total	11 / 12 Passed

Description

75%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is well-structured with an explicit 'Use when' clause and strong distinctiveness via an explicit negative trigger, though it names only one core action and uses pipeline jargon ('Codex', 'validation phase') over user-natural terms.

Suggestions

Add one or two more concrete actions (e.g., 'reproduce or falsify findings, record proof gaps') so specificity reaches the multi-action anchor.

Soften pipeline jargon by surfacing user-natural phrasings such as 'validate security findings' or 'check whether a vulnerability is real'.

Dimension	Reasoning	Score
Specificity	Names the domain and the core action ('determine whether one or more candidate security findings are valid') but describes a single validation action rather than listing multiple specific concrete actions, matching the score-2 anchor.	2 / 3
Completeness	It explicitly answers both what ('determine whether one or more candidate security findings are valid') and when (an explicit 'Use when Codex is already in the validation phase... or the user explicitly asks' trigger), satisfying the score-3 anchor.	3 / 3
Trigger Term Quality	The 'Use when' clause surfaces relevant terms ('security scan', 'candidate security findings', 'valid'), but it leans on pipeline-specific jargon ('Codex', 'validation phase of a security scan') rather than the natural phrasings a user would say, so common variations are missing.	2 / 3
Distinctiveness Conflict Risk	The explicit negative trigger ('Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans') carves a clear niche and separates validation from discovery/scan skills, making wrong-skill triggering unlikely.	3 / 3
	Total	10 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: openai/plugins
Path: plugins/codex-security/skills/validation/SKILL.md
Commit: 11c74d6

Reviewed: 17 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.