vulnerability-writeup

Write up vulnerabilities from disclosure documents, rough notes, supplied findings, PoCs, source code, or Codex Security scan output into polished, self-contained, source-backed reports. Use for one vulnerability or a disclosure campaign; a Codex Security scan is optional.

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

85%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced skill with a clean single-reference structure and strong validation/retry feedback loops. The main weakness is conciseness: the voice rule and the report-format reference are repeated across several sections and could be consolidated.

Suggestions

State the first-person "we"/"I" voice rule once in a single authoritative section and reference it elsewhere instead of restating it in Core Rules, the Sub-Agent Prompt, the Report Quality Bar, and Validation.

Cite `references/report-format.md` from one canonical place (e.g. the workflow step) rather than repeating the instruction to read it in full in multiple sections.

Consolidate the overlapping excellence/quality-bar checklists in Report Quality Bar and Technical Analysis Standard into one list to reduce redundancy.

Dimension	Reasoning	Score
Conciseness	The body avoids explaining concepts Claude already knows and is operationally focused, but it could be tightened: the first-person "we"/"I" voice rule is restated across Core Rules, the Sub-Agent Prompt, the Report Quality Bar, and Validation, and the `references/report-format.md` reference is pointed to repeatedly.	2 / 3
Actionability	It provides executable commands ("git show <rev>:<file>", "rg -n '\b(we\|We\|I\|our\|Our\|us)\b'", "make -n", "cd poc" then "make") and a copy-paste-ready Sub-Agent Prompt template, giving concrete direction rather than vague description.	3 / 3
Workflow Clarity	The Campaign Workflow is a clearly sequenced 12-step process with explicit validation checkpoints ("Review every sub-agent report yourself", "Run final validation over the whole report set") and feedback loops for recovery (reject, rerun a sub-agent with a tighter prompt, retry once).	3 / 3
Progressive Disclosure	Detailed report-format content is correctly split into the one-level-deep, real reference `references/report-format.md` and clearly signaled each time it is cited; the body is organized into distinct navigable sections rather than a monolithic wall.	3 / 3
	Total	11 / 12 Passed

Description

90%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description with an explicit "Use for" trigger and good natural trigger terms, well-distinguished from other skills. Its only weakness is that it describes a single concrete action rather than a list of several, capping specificity at the middle level.

Dimension	Reasoning	Score
Specificity	It names a clear action ("Write up vulnerabilities ... into polished, self-contained, source-backed reports") and enumerates six concrete input sources ("disclosure documents, rough notes, supplied findings, PoCs, source code, or Codex Security scan output"), but it is a single transformation rather than the multiple distinct actions the top anchor calls for.	2 / 3
Completeness	It states what it does ("Write up vulnerabilities ... into ... reports") and gives an explicit when clause ("Use for one vulnerability or a disclosure campaign; a Codex Security scan is optional"), satisfying both halves with an explicit trigger.	3 / 3
Trigger Term Quality	Natural security-domain terms a user would say are well covered: "vulnerabilities", "disclosure", "PoCs", "findings", "scan output", and "reports"; "Codex Security" is product jargon but the rest are terms users actually use.	3 / 3
Distinctiveness Conflict Risk	The niche is narrow and specific to vulnerability disclosure write-ups ("disclosure documents", "PoCs", "Codex Security scan output"), making it unlikely to trigger for unrelated skills.	3 / 3
	Total	11 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: openai/plugins
Path: plugins/codex-security/skills/vulnerability-writeup/SKILL.md
Commit: 11c74d6

Reviewed: 17 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.