Skip to main content
affpapa.org
RU EN
skill CX Codex GP ChatGPT official · OpenAI

triage-finding — Codex skill: what it does, how to install

Triages external security reports against repository code and SECURITY.md policies, assigning static-evidence verdicts without modifying files.

Install into Codex · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add openai/plugins --skill triage-finding -a codex
Open on GitHub

What triage-finding does

The skill evaluates security claims against local source code and scoped SECURITY.md files. It handles SARIF outputs, CVE entries, scanner alerts, bug bounty reports, and issues pulled from Jira, Linear, or GitHub. Every finding receives one of three verdicts: confirmed, not_actionable, or needs_review. Actionable items are ranked by exploitability.

Assessment relies entirely on static evidence, tracing entry points, sanitizers, and data flows to sinks. The skill does not run PoCs, execute builds, or trigger runtime tests. It refuses to invent scanner details, edit repository files, or discover unrelated vulnerabilities.

Install this when you need to process security queues and weed out false positives against documented security boundaries. If you need automated bug fixing or runtime validation, look elsewhere.

What it helps with

  • evaluate SARIF and CVE reports against static source code
  • filter out scanner false positives using repository SECURITY.md policies
  • import and normalize security tickets from Jira, Linear, or GitHub
  • rank confirmed vulnerabilities by exploitability

Example prompts for the agent

  • Triage this CVE against our repository and local SECURITY.md rules
  • Assess this Dependabot alert from GitHub to see if the vulnerable sink is reachable
  • Review this scanner report from Linear and return a triage verdict

How to install triage-finding

1Skills CLI (Vercel)

npx skills add openai/plugins --skill triage-finding -a codex

2Manually: put the files in place

.agents/skills/triage-finding/SKILL.md

For all projects use ~/.agents/skills/

From the same set201

The whole set →
supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs remotion-render official Remotion Exports videos and static stills from Remotion projects using CLI commands. CX Codex GP ChatGPT 3installs figma-create-new-file official Figma Creates blank Figma, FigJam, or Slides files inside draft folders. It resolves planKey and editor types before invoking Figma MCP tools. CX Codex GP ChatGPT 6installs swiftui-performance-audit official OpenAI Pinpoints SwiftUI runtime issues like frame drops, unresponsive taps, and excessive view body computations. Works code-first and guides Instruments profiling. CX Codex GP ChatGPT 109installs swiftui-liquid-glass official OpenAI This skill helps build and review SwiftUI Liquid Glass interfaces for iOS 26+. Use it when adopting the API or checking fallbacks, interaction, and design fit. CX Codex GP ChatGPT 121installs swiftui-ui-patterns official OpenAI This skill helps build and refactor SwiftUI interfaces, from navigation and state to layouts and controls. Use it for new screens or changes to an existing project. CX Codex GP ChatGPT 114installs swiftui-view-refactor official OpenAI Refactors SwiftUI view files into clean, testable structures with dedicated subview types and proper Observation ownership. CX Codex GP ChatGPT 113installs ios-memgraph-leaks official OpenAI Captures and inspects iOS leaks from a simulator process or .memgraph. Useful for tracing retained objects and checking a fix with before-and-after evidence. CX Codex GP ChatGPT 1,054installs

Similar

compliance-os Alireza Rezvani This skill selects applicable frameworks, maps shared controls, and builds a combined audit and evidence plan for multi-framework programs. Claude Code 33installs aims-audit Alireza Rezvani Runs a six-question ISO/IEC 42001 internal audit check for AI Management Systems. Helps verify readiness before stage 1 audits or when onboarding models. Claude Code 31installs git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. Claude Code 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. Claude Code CX Codex Cursor +1 56,300installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. Claude Code CX Codex Cursor +1 44,800installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. Claude Code CX Codex Cursor +1 52,200installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. Claude Code CX Codex Cursor +1 69,400installs

Questions about triage-finding

How do I install triage-finding in Codex?

Run npx skills add openai/plugins --skill triage-finding in your console. You can also supply the explicit platform flag -a codex.

What does triage-finding do?

It validates reported security issues against repository code using static analysis and assigns verdicts: confirmed, not actionable, or needs review.

Does triage-finding fix code or run tests?

No, the skill does not edit files, run test suites, or conduct dynamic testing. It strictly analyzes static evidence to evaluate existing claims.

See also

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor