finding-discovery Skill
Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans. Published by openai in plugins.
What is finding-discovery Skill?
Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans. Published by openai in plugins. This profile combines repository metadata with install, compatibility, and usage signals so developers can quickly decide whether it fits their agent workflow before opening the source repository.
Automated repository signals based on public metadata such as recency, license, installation evidence, and adoption. These are not a security audit or endorsement.
Key capabilities
- Includes SKILL.md support
- Reusable instructions support
- Security review
- Security review use cases
Technical details
- Install or run with Copy skill directory
When to use finding-discovery Skill
- Use it for security review.
Built with
Editorial notes
Source
- Creator: openai
- Repository: openai/plugins
- Skill file: plugins/codex-security/skills/finding-discovery/SKILL.md
What it does
Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.
Skill instructions
Security Finding Discovery Objective Investigate the proposed code or code changes for technically plausible security vulnerabilities using the threat model as context. Artifact Resolution The path references in this skill are the default locations for this phase. If the user explicitly provides a different path for a required input or output, use the user-provided path instead of the corresponding default path referenced in this skill. If a required input is still missing, stop and ask the user for it before continuing. Use the shared scan artifact path conventions in ../../references/scan-artifacts.md. SECURITY.md Guidance Gate Read ../../references/security-guidance.md and resolve the applicable policy before inspecting each source file. A delegated file-review worker must do the same before reading its assigned source. Code Diff Workflow If the scan target is for a targeted code-diff: - Read ../security-scan/references/scan-artifacts-and-ledger.md. - Generate rankinput.jsonl determ
Explore related resources
Frequently asked questions
What is finding-discovery?
finding-discovery is a open-source AI agent skill with Copy skill directory. Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change.
Who is finding-discovery best for?
finding-discovery is best for reusing agent instructions, scripts, and references, security review workflows.
How do I install finding-discovery?
Install or run finding-discovery using Copy skill directory. Check finding-discovery for the latest setup command.
Is finding-discovery actively maintained?
finding-discovery may need a closer maintenance check before production use.
Auto-fetched from GitHub.
