skills.rest
openai
openaiOFFICIAL
Explore all skills by this author →
WebsiteGitHub

finding-discovery

Discovers plausible security vulnerability candidates in code changes and repositories.

5.3k|765|Updated Mar 4, 2026
Search Tags:#diff analysis#vulnerability discovery#Security#SAST#cve#threat model#Code review
One-click install
npx skills add https://github.com/openai/plugins --skill finding-discovery
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: finding-discovery
Source: https://github.com/openai/plugins/tree/main/plugins/codex-security/skills/finding-discovery
Command: npx skills add https://github.com/openai/plugins --skill finding-discovery

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Security reviews often miss subtle vulnerabilities buried in large diffs or sprawling repositories. This Skill systematically investigates code changes and source files to surface technically plausible security finding candidates with concrete evidence, so nothing exploitable slips through before validation.

Core Features & Use Cases

  • Diff-Scoped Discovery: Reviews PR, commit, branch, and local patch diffs by generating ranked file inventories and deep-reviewing every changed file plus its direct dependencies.
  • Advisory-Seeded Scanning: Uses CVE, GHSA, and advisory context to seed discovery rows, keeping each seeded file, class, or hunk open until local code evidence closes it.
  • Structured Candidate Output: Emits candidates with affected locations, attacker-controlled sources, vulnerable sinks, broken controls, CWE IDs, and plausibility evidence for downstream validation.
  • Use Case: During a security scan of a large pull request, use this Skill to enumerate each independently reachable injection sink, auth bypass, or SSRF candidate as a separate ledger entry before handing the set to validation.

Quick Start

Use the finding-discovery skill to discover candidate security findings in the current repository or a given code change.

Frequently Asked Questions about finding-discovery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I discover security vulnerabilities in a code diff?▼

Run the finding-discovery phase on the diff, which generates a rank_input.jsonl inventory of changed files and deep-reviews each one. It records every plausible candidate with its attacker-controlled source, vulnerable sink, and closest broken control.

What types of vulnerabilities does security finding discovery look for?▼

It targets plausible candidates such as authorization bypass, confused deputy, SSRF, path traversal, injection with a real sink, cross-tenant data exposure, and trust-boundary escapes. It avoids generic maintainability complaints and duplicate variants of the same root issue.

Can finding discovery use CVE or advisory context?▼

Yes, advisory-seeded scans keep each seeded file, class, or hunk open as a ledger row until local code evidence closes it as reportable, suppressed, or not applicable. Neighboring same-CWE findings do not satisfy a seeded row unless they cover the same control and effect.

When should I not use finding discovery as the scan trigger?▼

Do not use it as the primary trigger for full PR, commit, branch, patch, or repository scans, since standard and deep discovery workers follow their own coordinator prompts. Use it only when already in the discovery phase or when explicitly asked to discover candidates.

Does finding discovery determine final severity ratings?▼

No, discovery only establishes technical plausibility and preserves evidence for each candidate. Final severity calibration and reportability decisions happen later during attack-path analysis using the severity policy.

Related Skills

Explore More Software Engineering Skills→
codexstar69codexstar69
479

commit-security-scan

Scan code changes for security vulnerabilities using STRIDE context.

Community
Intermediate
roberttmadsen13-delroberttmadsen13-del

exploitability-validation

Validate vulnerability findings through a deterministic six-stage pipeline.

Community
Advanced
ruvnetruvnet
70.1k

dependency-check

Scans project dependencies for known CVEs and outdated packages.

Community
Basic
pvillegapvillega
23

wcag-audit

Detect WCAG violations via ESLint plugins and axe-core runtime scans.

Community
Advanced