skills.rest
openai
openaiOFFICIAL
Explore all skills by this author →
WebsiteGitHub

track-findings

Track validated security scan findings as Linear, Jira, or GitHub issues and draft advisories.

5.3k|765|Updated Mar 4, 2026
Search Tags:#linear#vulnerability management#duplicate detection#Jira#security findings#github advisories#Issue tracking
One-click install
npx skills add https://github.com/openai/plugins --skill track-findings
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: track-findings
Source: https://github.com/openai/plugins/tree/main/plugins/codex-security/skills/track-findings
Command: npx skills add https://github.com/openai/plugins --skill track-findings

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

After a Codex Security scan produces validated findings, teams still need to file them into issue trackers without losing accuracy, creating duplicates, or leaking sensitive details. This Skill turns sealed scan results into reviewed, approval-gated Linear issues, Jira issues, GitHub issues, or draft GitHub security advisories.

Core Features & Use Cases

  • Multi-provider tracking: Create, reuse, or update findings in Linear, Jira Cloud (via Atlassian Rovo), GitHub issues, or private draft GitHub security advisories, using one provider and destination per run.
  • Duplicate detection and binding: Searches by canonical finding id and fingerprint before any write, choosing create, reuse, update, or blocked outcomes per finding.
  • Approval-gated writes with readback: Shows the exact payload for review, rechecks source and destination after approval, executes serially, and verifies every write through provider readback.
  • Use Case: After a sealed scan reports 12 validated findings, select a batch, preview the exact Jira issues with commit-pinned source links, approve once, and get verified issue URLs back.

Quick Start

Track the validated findings from my latest Codex Security scan as GitHub issues in the scanned repository, showing me a preview before writing anything.

Frequently Asked Questions about track-findings

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I track security scan findings in Jira or GitHub issues?▼

Validate the sealed scan directory with the tracking helper script, select the findings and destination, then review the exact previewed payload. After explicit approval, the Skill creates or reuses one issue per finding and verifies each write through provider readback.

Can I create GitHub security advisories from scan findings?▼

Yes, the github-advisory mode creates one private draft advisory per finding using authenticated gh api calls against github.com. It requires a verified git_revision target in the public canonical source repository and never updates or publishes existing advisories.

How many findings can be tracked in one batch?▼

Linear, Jira, and GitHub issue runs support an explicitly selected batch of up to 25 findings, processed serially in approved order. GitHub security advisories are strictly single-finding and do not support batches.

Does the skill check for duplicate issues before creating new ones?▼

Yes, it searches by canonical finding id and fingerprint before proposing any create, then reviews plausible semantic matches. Outcomes are create, reuse, update, or blocked, and ambiguous duplicate results stop the run.

What happens if a write fails or the result is uncertain?▼

The Skill never retries an uncertain create; it searches by finding id and fingerprint first and stops on ambiguity. A write is only reported complete after exact provider readback verifies the title, body, bindings, and metadata.

When should I not use this tracking workflow?▼

Do not use it to run scans or apply fixes; it only tracks already validated findings from a sealed scan bundle. It also blocks runs when the required provider app is unavailable, the destination visibility is unsafe, or source verification fails for advisory mode.

Related Skills

Explore More Software Engineering Skills→
idchain-worldidchain-world
16

solidity-auditor

Orchestrate parallel agents to audit Solidity contracts and generate security reports.

Official
Advanced
seb1nseb1n
147

Project Management

Decompose work into tasks and track progress across sprints.

Community
Advanced
endorlabsendorlabs
2

endor-explain

Fetch CVE or Finding details and assess project impact via dependencies.

Official
Advanced
RedHatProductSecurityRedHatProductSecurity
8

secdevai-export

Export security review findings into Markdown and SARIF report formats.

Official
Basic