finding-discovery — Codex skill: security findings
This skill searches code or changes for plausible security vulnerabilities in the context of a threat model. Use it during finding discovery, not to start a full scan.
npx skills add openai/plugins --skill finding-discovery -a codexWhat finding-discovery does
The skill investigates code for technically plausible vulnerabilities. For code changes, it follows how the affected paths influence authorization, trust boundaries, dangerous operations, and security controls. For a standalone repository-discovery request, it uses the relevant checklist without running the diff workflow.
Before inspecting files, it requires reading the security guidance and following artifact-storage rules. The targeted-diff workflow includes preparing file lists for review. If the review is too large for one pass, file-review subagents can be used when scan authorization allows them.
Install it when Codex is already in the finding-discovery phase or you explicitly ask it to look for candidate vulnerabilities in a repository or change. It should not be the primary trigger for a full PR, commit, branch, or patch scan.
What it helps with
- find plausible vulnerabilities in changed code
- trace how a change affects authorization checks
- review supporting files needed to understand a security path
- record independently reachable instances as separate candidates
Example prompts for the agent
- Review this diff for plausible security vulnerabilities using the threat model.
- Trace how these changes affect authorization and dangerous sinks.
- Find candidate vulnerabilities in this repository without starting a full scan.
How to install finding-discovery
1Skills CLI (Vercel)
npx skills add openai/plugins --skill finding-discovery -a codex2Manually: put the files in place
.agents/skills/finding-discovery/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add openai/plugins --skill finding-discovery -a claude-code2Manually: put the files in place
~/.claude/skills/finding-discovery/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/finding-discovery/
Manually: put the files in place
.cursor/skills/finding-discovery/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install openai/plugins finding-discovery2Manually: put the files in place
.github/skills/finding-discovery/SKILL.mdPlatform CLI
gemini skills install https://github.com/openai/plugins --path plugins/codex-security/skills/finding-discoveryManually: put the files in place
.devin/skills/finding-discovery/SKILL.mdThe legacy .windsurf/skills/ path still works
Claude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
From the same set201
The whole set →Similar
Questions about finding-discovery
How do I install finding-discovery in Codex?
Run npx skills add openai/plugins --skill finding-discovery. To target Codex explicitly, run npx skills add openai/plugins --skill finding-discovery -a codex.
What does finding-discovery do?
It investigates code or changes for plausible security vulnerabilities in the context of a threat model. For changes, it follows relevant paths through controls and dangerous operations.
Should I use finding-discovery to start a full PR scan?
No. It is for the finding-discovery phase or an explicit request to find candidate vulnerabilities. It should not be the primary trigger for a full PR, commit, branch, or patch scan.
