track-findings — Codex skill: what it does, how to install
This skill moves validated Codex Security findings into Linear, Jira, or GitHub. Use it when scan results are reviewed and ready for controlled tracking.
npx skills add openai/plugins --skill track-findings -a codexWhat track-findings does
track-findings takes findings from one sealed scan and prepares them for a selected destination: Linear, Jira, GitHub Issues, or a draft GitHub Security Advisory. It validates the source artifacts, searches for matches by finding ID and fingerprint, previews the exact write payload, and waits for approval. It does not scan code or fix findings.
The skill uses validate_tracking_source.py and reads scan-manifest.json plus findings.json. It also handles batch selection, access checks, duplicate review, and provider-specific routing. GitHub CLI (gh) is supported and required for advisories. Jira work uses references/jira.md; advisory work uses references/github-security-advisories.md. You need a valid scan directory and access to the selected team, project, or repository.
Install it when validated findings need a reviewed path into an issue tracker or advisory workflow. Choose another skill for scanning or code fixes.
What it helps with
- send validated findings to Linear
- create an issue batch in Jira or GitHub
- check duplicates by finding ID and fingerprint
- draft a GitHub security advisory
- preview a write before approval
Example prompts for the agent
- Move the validated findings from this scan directory to GitHub Issues and show the exact payload first.
- Check the finding ID and fingerprint in Linear, find duplicates, and prepare a batch of issues.
- Prepare a draft GitHub Security Advisory for this finding and ask for approval before writing.
How to install track-findings
1Skills CLI (Vercel)
npx skills add openai/plugins --skill track-findings -a codex2Manually: put the files in place
.agents/skills/track-findings/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add openai/plugins --skill track-findings -a claude-code2Manually: put the files in place
~/.claude/skills/track-findings/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/track-findings/
Manually: put the files in place
.cursor/skills/track-findings/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install openai/plugins track-findings2Manually: put the files in place
.github/skills/track-findings/SKILL.mdPlatform CLI
gemini skills install https://github.com/openai/plugins --path plugins/codex-security/skills/track-findingsManually: put the files in place
.devin/skills/track-findings/SKILL.mdThe legacy .windsurf/skills/ path still works
Claude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
From the same set201
The whole set →Similar
Questions about track-findings
How do I install track-findings in Codex?
Run npx skills add openai/plugins --skill track-findings or npx skills add openai/plugins --skill track-findings -a codex. The skill file is placed at .agents/skills/track-findings/SKILL.md.
What does track-findings do?
It validates findings from one sealed scan, checks for existing records, and prepares reviewed writes to Linear, Jira, GitHub Issues, or a draft GitHub Security Advisory.
Can track-findings scan or fix code?
No. It is for findings that have already been validated. GitHub Security Advisories require one exact finding ID and do not support batches.
