# Finding Discovery

Use when Codex is already in the finding-discovery phase of a security scan or the user...

- Repository: https://github.com/openai/codex-security (11278 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add openai/codex-security --skill finding-discovery -g -a claude-code -y`
Codex: `npx skills add openai/codex-security --skill finding-discovery -g -a codex -y`
Cursor: `npx skills add openai/codex-security --skill finding-discovery -g -a cursor -y`
Gemini CLI: `npx skills add openai/codex-security --skill finding-discovery -g -a gemini-cli -y`

## Description

Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Security Finding Discovery

Identify technically plausible security vulnerabilities in the authorized source, using the threat model and applicable security policy. Discovery preserves evidence for later validation; it does not decide final severity.

Read `../../references/artifact-storage.md` before saving output and `../../references/security-guidance.md` before source review. Resolve applicable policy for each reviewed path, including delegated assignments. Honor explicit input and output paths; ask for an explicitly required input only when its absence prevents the requested analysis.

## Select the Workflow

Standard and Deep workers use their coordinator's self-contained prompts rather than this phase skill.

- **Running compact diff:** read the supplied inventory through `list_codex_security_review_items`, review every assigned changed file, and record all candidates once with `record_codex_security_discovery_candidates`. Do not create ranked worklists, per-finding ledgers, receipts, or discovery reports.
- **Standalone diff without a compact inventory:** use `../security-scan/references/scan-artifacts-and-ledger.md` for the changed-file worklist and retained phase artifacts.
- **Standalone repository discovery:** apply the evidence criteria below to the authorized source and return the candidates and coverage limitations. Do not start a scan or run the diff worklist pipeline.

For a diff, inspect the actual changed behavior, including deleted files at the baseline revision. Follow supporting code far enough to understand the affected boundary; expand to sibling callers when a changed shared control affects them. Do not broaden into an unrelated repository audit.

## Evidence Criteria

The rest: https://github.com/openai/codex-security/blob/HEAD/plugins/codex-security/skills/finding-discovery/SKILL.md