[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-openai-finding-discovery":3,"mdc--mhcqgy-key":33,"related-org-openai-finding-discovery":1159,"related-repo-openai-finding-discovery":1364},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":22,"repoUrl":23,"updatedAt":24,"license":25,"forks":26,"topics":27,"repo":28,"sourceUrl":31,"mdContent":32},"finding-discovery","discover potential security vulnerabilities in code","Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"openai","OpenAI","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fopenai.png",[12,16,19],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Codex","codex",{"name":20,"slug":21,"type":15},"Code Analysis","code-analysis",3992,"https:\u002F\u002Fgithub.com\u002Fopenai\u002Fplugins","2026-05-01T06:02:30.799121",null,465,[],{"repoUrl":23,"stars":22,"forks":26,"topics":29,"description":30},[],"OpenAI Plugins","https:\u002F\u002Fgithub.com\u002Fopenai\u002Fplugins\u002Ftree\u002FHEAD\u002Fplugins\u002Fcodex-security\u002Fskills\u002Ffinding-discovery","---\nname: finding-discovery\ndescription: Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.\n---\n\n# Security Finding Discovery\n\n## Objective\n\nInvestigate the proposed code or code changes for technically plausible security vulnerabilities using the threat model as context.\n\n## Artifact Resolution\n\nThe path references in this skill are the default locations for this phase.\nIf the user explicitly provides a different path for a required input or output, use the user-provided path instead of the corresponding default path referenced in this skill.\nIf a required input is still missing, stop and ask the user for it before continuing.\nUse the shared scan artifact path conventions in `..\u002F..\u002Freferences\u002Fscan-artifacts.md`.\n\n## SECURITY.md Guidance Gate\n\nRead `..\u002F..\u002Freferences\u002Fsecurity-guidance.md` and resolve the applicable policy before inspecting each source file. A delegated file-review worker must do the same before reading its assigned source.\n\n### Code Diff Workflow\nIf the scan target is for a targeted code-diff:\n\n- Read `..\u002Fsecurity-scan\u002Freferences\u002Fscan-artifacts-and-ledger.md`.\n- Generate `rank_input.jsonl` deterministically from changed source-like files with `\u003Cpython_command> \u003Cplugin_dir>\u002Fscripts\u002Fgenerate_rank_input.py make-diff-rank-input --repo \u003Crepo_root> --base \u003Cbase> --mode revisions --head \u003Chead> --out \u003Cdiscovery_dir>\u002Frank_input.jsonl` for PR, commit, and branch diffs, or `\u003Cpython_command> \u003Cplugin_dir>\u002Fscripts\u002Fgenerate_rank_input.py make-diff-rank-input --repo \u003Crepo_root> --base \u003Cbase> --mode local-patch --out \u003Cdiscovery_dir>\u002Frank_input.jsonl` for a local patch.\n- Copy every diff row into `deep_review_input.jsonl` with `\u003Cpython_command> \u003Cplugin_dir>\u002Fscripts\u002Fgenerate_rank_input.py copy-deep-review-input --rank-input \u003Cdiscovery_dir>\u002Frank_input.jsonl --out \u003Cdiscovery_dir>\u002Fdeep_review_input.jsonl`. Diff scans do not rank or drop changed files before deep review.\n- Add directly supporting files required to understand the changed security behavior only when repository evidence shows they are needed. Do not use them to broaden into unrelated repository-wide enumeration.\n- Deep-review every file in `deep_review_input.jsonl` using the shared scoped file-review rules.\n- Stay anchored to the changed code and directly supporting files. Unchanged siblings are context or negative controls unless the diff newly reaches them, weakens their shared control, or changes a shared sink\u002Fhelper they depend on.\n- When the diff is too large to review credibly as one parent-agent pass, use file-review subagents when they are available under the resolved scan authorization and follow the shared scoped deep-review rules in `..\u002Fsecurity-scan\u002Freferences\u002Fscan-artifacts-and-ledger.md#scoped-deep-review`.\n\n### Exhaustive Repository Or Scoped-Path Workflow\n\nIf the scan target is repository-wide or a scoped path, follow the procedure in `..\u002Fsecurity-scan\u002Freferences\u002Frepository-wide-scan.md` and every required reference it lists.\n\n## Discovery Checklist\n\nUse this checklist to keep discovery specific without turning it into validation or attack-path analysis:\n\n- Use tools to inspect the changed files and the minimum supporting files they rely on before deciding anything.\n- Treat the commit message and title as potentially incomplete or misleading; trust the actual code path more than the narrative.\n- Follow the entire changed-code chain far enough to understand how the diff affects authorization, trust boundaries, dangerous sinks, or security controls.\n- Prefer multiple distinct finding families only when they come from different root causes; do not split one issue into cosmetic variants, but keep independently reachable instances as separate candidate entries.\n- When the diff changes a shared helper, guard, route pattern, template pattern, or sink wrapper, expand to sibling call sites that the changed code directly affects, and keep each vulnerable instance addressable.\n- Look for attacker-controlled input, broken enforcement, or dangerous sinks introduced or made reachable by the change.\n- Stay anchored to the diff and the supporting files it depends on rather than drifting into unrelated repository scanning.\n- For repository-wide and scoped-path scans, stay anchored to `rank_input.jsonl`, `deep_review_input.jsonl`, the runtime inventory, and the coverage ledger rather than drifting into arbitrary text search.\n- For advisory-seeded repository-wide and scoped-path scans, keep any supplied advisory row id, exact file, line, source, sink, or broken-control hint visible in the candidate ledger. A neighboring same-CWE finding can be an additional candidate, but it does not satisfy the seeded row unless it covers the same vulnerable control and effect.\n- Do not group many vulnerable files under one candidate when the files have separate line-level source\u002Fsink\u002Fcontrol evidence.\n- When a dangerous sink has multiple call sites, enumerate each call site with its own source and closest control.\n- When repeated templates, query builders, parser operations, auth\u002Fobject endpoints, or shared-helper callers are independently reachable, keep each vulnerable file and sink\u002Fcontrol line as its own candidate instance even if the final report later groups related prose.\n- When source\u002Fsink evidence crosses a wrapper into a shared sink\u002Fcontrol helper, include both locations in the candidate so validation can test reachability without losing the root vulnerable line.\n- When a concrete operation, strategy, converter, validator, or handler subclass selects the attacker-controlled operation semantics and delegates into a shared broken control or sink, include that subclass method or constructor as an affected candidate location alongside the shared helper. Do not replace it with only the abstract base class or shared helper.\n- If a candidate claim says that a shared parser, loader, evaluator, auth guard, or operation family affects \"all\", \"every\", or \"any\" concrete implementation, enumerate the concrete implementations that make that claim true. Do not leave concrete vulnerable classes only in prose.\n- When a broad candidate bucket names a whole operation family such as \"all SQL trigger variants\", \"all deserialization variants\", \"all path traversal helpers\", \"all SSRF modes\", \"all generated framework adapters\", or \"all unauthenticated mutation endpoints\", expand it into child candidates keyed by the concrete exported function, route branch, sink statement, API mode, parser\u002Fdeserializer variant, or protected action before handing the set to validation.\n- If one route or helper exposes multiple dangerous operations in the same family, such as `execute`\u002F`executemany`\u002F`executescript`, `pickle.load`\u002F`pickle.loads`\u002F`yaml.load`\u002F`yaml.load_all`, separate path\u002Ffile helper methods, insert\u002Fselect\u002Fdelete\u002Fupdate query builders, or create\u002Fdelete\u002Freset\u002Fadmin\u002Fjob actions without auth, keep those operations as separate candidate instances when attackers can trigger them independently.\n- Treat shared or generated wrappers as reachability evidence, not as a reason to collapse child sink variants. The wrapper can be a shared affected location, but each independent sink, control, or protected action still needs its own candidate id.\n- When the scan context or evidence seeds a specific boundary package, class family, or vulnerability family, keep that seeded row open until that exact package or class family is closed. A nearby same-family finding is supporting context, not a replacement for the seeded root control.\n- When CVE, GHSA, advisory, release, issue, or package-version context is provided, use any advisory seed research artifact as discovery input. Preserve seed-researched files\u002Ffunctions\u002Fclasses\u002Fhunks as ledger rows until local code evidence closes them as reportable, suppressed, not applicable, or deferred.\n- When CVE\u002Fadvisory context has a generic or unhelpful category, do not fall back directly to broad hotspot findings. First derive a seed shortlist from advisory\u002Ffix\u002Frelease\u002Fsecurity-test sources when available; if that is unavailable, run a local regression-seed pass over project-specific protocol, parser, validator, utility, and version\u002Fcomparison helpers plus the CVE\u002Fadvisory terms.\n- If discovery opens or greps a seed-target file, class, package, or hunk, create an explicit closure row for it. Do not leave the exact seed only in tool output, background context, or suppressed-candidate prose. If a broader sibling finding shares the same proof tuple, keep the seed anchor file\u002Fline as an affected location; otherwise close the seed row separately.\n- For advisory-led rows, do not replace the exact seeded construct with a neighboring hotspot just because the neighboring issue is easier to exploit or validate. Keep the seeded row open until local repository evidence independently supports or disproves the same source, broken control, and impact tuple.\n- For shared deserialization, class-resolution, template, and auth controls, treat the resolver\u002Ffilter\u002Fallowlist\u002Fdenylist\u002Fguard line as a candidate location when downstream transports or callers prove reachability. Do not anchor only on the more dramatic transport if the broken control is reusable.\n- For deserialization and object-construction families, enumerate concrete codec, deserializer, converter, and container handlers registered by the parser or serialization config, including array, collection, map, bean, enum, throwable, and generic-object handlers. A top-level parser\u002Fconfig finding does not close a concrete codec row when that codec recursively invokes parsing, type resolution, conversion, or object construction on attacker-controlled data.\n- For file-format object models, enumerate primitive\u002Fcontainer helper methods that convert or traverse attacker-controlled document structures, including `to*Array`, `get*`, `getObject`, numeric conversion, `parse*`, iterator, `size`, unchecked casts, and allocation loops. Treat these helpers as candidate root controls when malformed documents can trigger type confusion, exceptions, unbounded traversal, or memory\u002FCPU exhaustion.\n- If the repository-wide worklist or coverage ledger identifies a central object-model package for an untrusted format, include that package's array, dictionary, node, collection, and primitive conversion helpers as discovery rows before closing the parser family. A parser, filter, or codec finding in a neighboring package does not close unchecked conversion helpers in the core object model.\n- Object-model helper sweeps create mandatory discovery rows first, not automatic reportable findings. Promote them only when malformed or adversarial input plausibly reaches the helper and the missing type, size, shape, recursion, numeric, or conversion guard can cause crash, denial of service, parser confusion, authorization bypass, or another concrete security impact.\n- Do not suppress deterministic parser\u002Fhelper crashes as mere robustness when untrusted remote, protocol, document, archive, or package input can reach the missing guard and abort a service, request worker, parser pipeline, or security negotiation. Suppression needs exact containment evidence such as caller-side recovery, input prevalidation equivalent to the missing guard, or a non-security-only boundary.\n- For structured patch\u002Fedit\u002Fapply APIs such as JSON Patch, Graph Patch, document edits, or config mutations, enumerate concrete request-selected operations like add, remove, replace, move, copy, and test. Keep operation-specific path transforms, array append handling, wildcard selection, or object-binding lines candidate-visible when they feed a shared evaluator or binder.\n- In concrete operation classes, inspect specialized helper methods and not only the top-level `perform`, `handle`, or `apply` override. If the operation-specific helper splits, filters, canonicalizes, or rebuilds attacker-controlled paths before delegating to a shared evaluator or binder, use that helper line as the candidate root control.\n- When a concrete operation has special-case branches such as append, wildcard, fallback, copy\u002Fmove `from`, default-value, or type-resolution paths, keep the branch predicate and branch-local transform lines as affected locations when they bypass or narrow the shared validator. A shared helper finding does not close branch-specific root controls.\n- When class-filter, allowlist, denylist, blacklist, whitelist, or resolver logic is duplicated across core, server, client, remoting, plugin, or import packages, include the runtime\u002Fexported equivalents as candidate locations when they implement the same broken control. A transport callsite proves reachability, but it does not replace the reusable resolver implementation.\n- In framework or library scans, stored client, tenant, application, identity-provider, exception, or imported-configuration values are cross-boundary inputs when later rendered, evaluated, parsed, or used for authorization and the instance has a plausible runtime path from an application, tenant, identity provider, import, or other boundary. Do not suppress solely because the writer is outside the current repository unless repository evidence proves the value is trusted-only for normal deployments.\n- For SQL\u002FNoSQL\u002FLDAP\u002FXPath and similar query APIs, do not suppress a candidate solely because the endpoint already accepts user-controlled data, because the operation is an insert\u002Fupdate, or because a later business check appears to limit the final application effect. If attacker-controlled input reaches query syntax or selector operators through a plausible runtime path, carry the candidate to validation with the later check recorded as possible counterevidence.\n- Do not collapse separate high-impact proof tuples into one candidate only because they share a route or helper. Split command execution, SSRF, path\u002Ffile impact, XML\u002Fparser behavior, XSS\u002Ftemplate execution, and authz\u002Fstate-change impact when the sink, closest control, or impact differs.\n- For outbound request surfaces such as `downloadFrom`, URL importers, webhook\u002Fcallback clients, preview\u002Frender fetchers, and redirect-following HTTP clients, enumerate each attacker-controlled destination source and its closest allow\u002Fdeny\u002Ffilter\u002Fredirect control. Do not suppress SSRF because the fetch\u002Fcallback is an intended feature, because filters are optional or empty by default, or because a sibling route found a louder file\u002Fpath issue; keep the network row when user input can select a destination and the hard boundary is incomplete, operator-configured, or only pre-request.\n- In XML\u002Fparser\u002Fdeserializer surfaces, enumerate default parser factories, converters, validators, transformers, unmarshal\u002Fparse calls, and handler entrypoints independently. A safe sibling parser path is negative control for that sibling, not suppression evidence for a different default factory or converter.\n- For command\u002Faction runners, enumerate every attacker-controllable argument type and execution mode before closing command-injection coverage. Treat type-safety maps, unsafe-type denylists, template substitution, shell wrapping, direct-exec branches, webhook\u002FAPI argument ingestion, and frontend-only widget constraints as separate controls. A denylist that covers `raw`, `url`, or `email` does not close `password`, `checkbox`, `confirmation`, choice, or other nil\u002Fno-op typecheck branches that can still render into shell commands.\n- For XML parser and converter candidates, include feature-setup and resolver lines when hardening is best-effort, fail-open, or incomplete. `FEATURE_SECURE_PROCESSING` alone, swallowed\u002Flogged `setFeature` failures, or a safe default parser does not suppress caller-supplied parser factories\u002Freaders or converter paths that create SAX\u002FDOM\u002FStAX\u002FTransformer sources from untrusted data.\n- For resource-serving and static-file paths, include the allowlist, matcher, canonicalization, URL decoding, and resource-selection line that decides whether an attacker-chosen path is allowed. Do not replace a vulnerable legacy or package API handler with a safer sibling handler. For restore\u002Fimport\u002Fexport, backup, admin, or login-named routes, also verify the exact global middleware and decorator semantics before assuming authentication is required; optional or conditional login wrappers keep the route anonymous when the enabling auth configuration is absent.\n- For path-sensitive filesystem families, enumerate concrete exported operations for restore\u002Fimport\u002Fexport, backup\u002Frestore, archive extraction, file copy\u002Fmove, download\u002Fopen, and key\u002Fconfig fetch helpers. Keep decode, join, normalize, canonicalize, strip-prefix, extension-check, and destination-selection lines candidate-visible for each independently reachable operation.\n- For archive extraction and restore\u002Fimport flows, keep the archive-member name, destination join, containment check, and extract\u002Fwrite call visible as candidate root controls. Do not replace them with a later copy, import, UUID\u002Fmanifest gate, or top-level file-selection step if extraction or filesystem writes already happened first. Generic claims that a standard-library helper normalizes paths are not enough; keep the row open until the code shows exact per-entry containment before extraction or write, including any symlink, hardlink, metadata, or recursive-copy path that could later promote attacker-controlled content into an imported subtree. Do not require the write to escape the overall app\u002Fdatastore root; overwriting trusted config, peer-object directories, shared roots, or imported subtrees inside that root still counts as file-impact.\n- When upload\u002Farchive-member rows have a precise source to decoded\u002Ffiltered member name to destination join\u002Fwrite tuple, keep them as candidates even if runtime package reproduction is unavailable or confidence is medium. A cleaner download\u002Fopen traversal or API\u002Fauth issue in the same repository is not a reason to drop the archive-member row; report the archive row at calibrated severity\u002Fconfidence or keep an explicit deferred ledger row with the missing proof.\n- When the same product area also has auth, secret, or configuration bugs, keep the path\u002Ffile candidate open until its own proof tuple is closed. Do not replace it with the louder neighboring issue.\n- In framework or library scans, do not suppress a high-impact candidate solely because the affected API is deprecated, opt-in, or documented as dangerous. State that as a precondition; keep the candidate when the shipped runtime code contains a bypassable control in the restricted or normal usage path and the instance has a plausible cross-boundary source and runtime\u002Fdeployment path.\n- In auth\u002Fauthz surfaces, enumerate public webhook, status, callback, and API endpoints that read protected objects, trigger builds\u002Fjobs, or mutate protected state independently from nearby credential or configuration bugs.\n- For stateful authentication protocols, include the line that installs or reuses principals, credentials, tokens, issuers, or protocol state after a pre-authentication, TLS-upgrade, redirect, assertion, or identity-provider transition. Missing rebind\u002Freauthentication or validated-vs-consumed mismatches are candidate controls when they can authenticate the wrong identity.\n- In SSO\u002FSAML\u002Ffederation packages, keep response\u002Fassertion validators distinct from generic claims authorizers and service-method authorization. Include assertion selection, list indexing, `getDOM`, `cloneNode`, signed-object lookup, subject confirmation, recipient, audience, destination, ACS URL, and issuer-binding lines when they decide which assertion is trusted or returned.\n- In auth\u002Ftoken\u002Fassertion validators, watch for a validation loop or `foundValid*` flag followed by a separate fixed-index, first\u002Flast-element, clone, serialization, or return path. Treat the later object-selection line as the broken control until exact counterevidence proves the validated object and consumed object are identical and equally bound.\n- For realm\u002Fauthenticator packages, enumerate concrete implementations such as LDAP, Kerberos, PAM, SAML, OAuth\u002FOIDC, or custom `Realm` classes before promoting a nearby generic HTTP auth finding. In TLS-upgraded or multi-step binds, keep the bind\u002Frebind and principal\u002Fcredential installation line candidate-visible.\n- In protocol-heavy repositories, inspect low-level version, capability, feature, and negotiation utility classes even if the most obvious candidates are REST\u002Fupload\u002Fadmin hotspots. Search for helper names such as `Version`, `VersionUtil`, `versionCompare`, `versionMatch`, `Capability`, `Feature`, `Negotiation`, `parseInt`, `split`, `matches`, and comparator methods, then close paired validator\u002Fparser rows explicitly.\n- For self-service update routes, include guard or predicate methods that compare requested objects against persisted objects. Treat missing checks on security-sensitive scalar fields and collection aliases as candidate locations when they can change identity, trust state, tenant membership, roles, groups, or account recovery properties.\n- When a template or config pattern appears repeatedly, enumerate each affected file\u002Fline and note any nearby safe control that should not be reported.\n- For diff-scoped scans, include `relevant_lines` only when the bug overlaps the diff and those lines are genuinely relevant to the issue.\n- For recursive placeholder or template findings, include the helper\u002Fparser setup line that enables recursive expansion or expression evaluation along with the resolver\u002Fevaluation\u002Frender line.\n- Include CWE IDs when known; use an empty list when the class is unclear.\n\n## Finding Bar\n\nPrefer technically plausible candidates such as:\n\n- authz bypass\n- confused deputy\n- SSRF\n- path traversal\n- injection with a real sink\n- cross-tenant data exposure\n- sensitive state change without correct enforcement\n- sandbox or trust-boundary escape\n\nDiscovery identifies plausible candidates and preserves their evidence; it does not own final severity calibration. For reportability and severity examples, defer to `..\u002Fattack-path-analysis\u002Freferences\u002Fseverity-policy.md` during attack-path analysis.\n\nAvoid:\n\n- generic \"needs more validation\" comments with no exploit path\n- maintainability complaints\n- duplicate variants of the same root issue\n\n## Output Contract\n\nIf there are no plausible candidates, return a no-findings result.\n\nOtherwise, for each candidate include:\n\n- candidate id\n- title\n- affected locations, with labels when more than one applies: `entrypoint\u002Fwrapper`, `root_control`, `sink`, and `concrete_implementation`\n- instance key in the form `\u003Cfamily>:\u003Cfile>:\u003Cline>` for repository-wide and scoped-path scans\n- seed or ledger row id for repository-wide and scoped-path seeded\u002Froot-control rows when available\n- advisory\u002Fsource reference for advisory-seeded rows when available\n- attacker-controlled source\n- vulnerable sink or broken control\n- impact\n- why the issue is plausible from the current code\n- closest apparent control and why it is absent, bypassed, mis-scoped, or incomplete\n- whether validation is recommended\n- `relevant_lines` for diff-scoped scans when the bug overlaps the diff and those lines are relevant to the bug\n- taxonomy with CWE IDs when known\n- enough evidence that a later reviewer can understand why the candidate is technically plausible before validation\n\nWhen candidates are emitted, create the per-finding directory from `..\u002F..\u002Freferences\u002Fscan-artifacts.md` and append one discovery receipt to that finding's candidate ledger. The ledger row should identify the candidate, scan scope, discovery status, affected locations, and the discovery artifact or evidence that produced it.\n\n\n## Hard Rules\n\n- Use the tools to examine repository files before making decisions.\n- Focus on the actual changes, not the commit message.\n- Stay anchored to the diff and the files it relies on for diff-scoped scans. For repository-wide and scoped-path scans, treat the resolved audit scope as in scope and ignore diff-overlap restrictions for affected locations.\n- Candidate discovery is about plausibility, not final severity.\n- Do not emit an untracked candidate. Every candidate finding needs a stable candidate id and a discovery receipt in its candidate-ledger path from `..\u002F..\u002Freferences\u002Fscan-artifacts.md` so later validation and attack-path analysis can prove coverage for that exact finding.\n- Do not add `relevant_lines` when no bug exists. For diff-scoped scans, add `relevant_lines` only when the bug overlaps the diff and those lines are relevant to the bug.\n- Do not turn discovery into full validation or full severity calibration.\n- Continue reviewing until no additional distinct plausible candidates remain.\n- Save a final visible report using the finding discovery report path from `..\u002F..\u002Freferences\u002Fscan-artifacts.md`.\n",{"data":34,"body":35},{"name":4,"description":6},{"type":36,"children":37},"root",[38,47,54,60,66,80,86,99,106,111,211,217,230,236,241,841,847,852,895,908,913,931,937,942,947,1066,1078,1084],{"type":39,"tag":40,"props":41,"children":43},"element","h1",{"id":42},"security-finding-discovery",[44],{"type":45,"value":46},"text","Security Finding Discovery",{"type":39,"tag":48,"props":49,"children":51},"h2",{"id":50},"objective",[52],{"type":45,"value":53},"Objective",{"type":39,"tag":55,"props":56,"children":57},"p",{},[58],{"type":45,"value":59},"Investigate the proposed code or code changes for technically plausible security vulnerabilities using the threat model as context.",{"type":39,"tag":48,"props":61,"children":63},{"id":62},"artifact-resolution",[64],{"type":45,"value":65},"Artifact Resolution",{"type":39,"tag":55,"props":67,"children":68},{},[69,71,78],{"type":45,"value":70},"The path references in this skill are the default locations for this phase.\nIf the user explicitly provides a different path for a required input or output, use the user-provided path instead of the corresponding default path referenced in this skill.\nIf a required input is still missing, stop and ask the user for it before continuing.\nUse the shared scan artifact path conventions in ",{"type":39,"tag":72,"props":73,"children":75},"code",{"className":74},[],[76],{"type":45,"value":77},"..\u002F..\u002Freferences\u002Fscan-artifacts.md",{"type":45,"value":79},".",{"type":39,"tag":48,"props":81,"children":83},{"id":82},"securitymd-guidance-gate",[84],{"type":45,"value":85},"SECURITY.md Guidance Gate",{"type":39,"tag":55,"props":87,"children":88},{},[89,91,97],{"type":45,"value":90},"Read ",{"type":39,"tag":72,"props":92,"children":94},{"className":93},[],[95],{"type":45,"value":96},"..\u002F..\u002Freferences\u002Fsecurity-guidance.md",{"type":45,"value":98}," and resolve the applicable policy before inspecting each source file. A delegated file-review worker must do the same before reading its assigned source.",{"type":39,"tag":100,"props":101,"children":103},"h3",{"id":102},"code-diff-workflow",[104],{"type":45,"value":105},"Code Diff Workflow",{"type":39,"tag":55,"props":107,"children":108},{},[109],{"type":45,"value":110},"If the scan target is for a targeted code-diff:",{"type":39,"tag":112,"props":113,"children":114},"ul",{},[115,127,156,177,182,194,199],{"type":39,"tag":116,"props":117,"children":118},"li",{},[119,120,126],{"type":45,"value":90},{"type":39,"tag":72,"props":121,"children":123},{"className":122},[],[124],{"type":45,"value":125},"..\u002Fsecurity-scan\u002Freferences\u002Fscan-artifacts-and-ledger.md",{"type":45,"value":79},{"type":39,"tag":116,"props":128,"children":129},{},[130,132,138,140,146,148,154],{"type":45,"value":131},"Generate ",{"type":39,"tag":72,"props":133,"children":135},{"className":134},[],[136],{"type":45,"value":137},"rank_input.jsonl",{"type":45,"value":139}," deterministically from changed source-like files with ",{"type":39,"tag":72,"props":141,"children":143},{"className":142},[],[144],{"type":45,"value":145},"\u003Cpython_command> \u003Cplugin_dir>\u002Fscripts\u002Fgenerate_rank_input.py make-diff-rank-input --repo \u003Crepo_root> --base \u003Cbase> --mode revisions --head \u003Chead> --out \u003Cdiscovery_dir>\u002Frank_input.jsonl",{"type":45,"value":147}," for PR, commit, and branch diffs, or ",{"type":39,"tag":72,"props":149,"children":151},{"className":150},[],[152],{"type":45,"value":153},"\u003Cpython_command> \u003Cplugin_dir>\u002Fscripts\u002Fgenerate_rank_input.py make-diff-rank-input --repo \u003Crepo_root> --base \u003Cbase> --mode local-patch --out \u003Cdiscovery_dir>\u002Frank_input.jsonl",{"type":45,"value":155}," for a local patch.",{"type":39,"tag":116,"props":157,"children":158},{},[159,161,167,169,175],{"type":45,"value":160},"Copy every diff row into ",{"type":39,"tag":72,"props":162,"children":164},{"className":163},[],[165],{"type":45,"value":166},"deep_review_input.jsonl",{"type":45,"value":168}," with ",{"type":39,"tag":72,"props":170,"children":172},{"className":171},[],[173],{"type":45,"value":174},"\u003Cpython_command> \u003Cplugin_dir>\u002Fscripts\u002Fgenerate_rank_input.py copy-deep-review-input --rank-input \u003Cdiscovery_dir>\u002Frank_input.jsonl --out \u003Cdiscovery_dir>\u002Fdeep_review_input.jsonl",{"type":45,"value":176},". Diff scans do not rank or drop changed files before deep review.",{"type":39,"tag":116,"props":178,"children":179},{},[180],{"type":45,"value":181},"Add directly supporting files required to understand the changed security behavior only when repository evidence shows they are needed. Do not use them to broaden into unrelated repository-wide enumeration.",{"type":39,"tag":116,"props":183,"children":184},{},[185,187,192],{"type":45,"value":186},"Deep-review every file in ",{"type":39,"tag":72,"props":188,"children":190},{"className":189},[],[191],{"type":45,"value":166},{"type":45,"value":193}," using the shared scoped file-review rules.",{"type":39,"tag":116,"props":195,"children":196},{},[197],{"type":45,"value":198},"Stay anchored to the changed code and directly supporting files. Unchanged siblings are context or negative controls unless the diff newly reaches them, weakens their shared control, or changes a shared sink\u002Fhelper they depend on.",{"type":39,"tag":116,"props":200,"children":201},{},[202,204,210],{"type":45,"value":203},"When the diff is too large to review credibly as one parent-agent pass, use file-review subagents when they are available under the resolved scan authorization and follow the shared scoped deep-review rules in ",{"type":39,"tag":72,"props":205,"children":207},{"className":206},[],[208],{"type":45,"value":209},"..\u002Fsecurity-scan\u002Freferences\u002Fscan-artifacts-and-ledger.md#scoped-deep-review",{"type":45,"value":79},{"type":39,"tag":100,"props":212,"children":214},{"id":213},"exhaustive-repository-or-scoped-path-workflow",[215],{"type":45,"value":216},"Exhaustive Repository Or Scoped-Path Workflow",{"type":39,"tag":55,"props":218,"children":219},{},[220,222,228],{"type":45,"value":221},"If the scan target is repository-wide or a scoped path, follow the procedure in ",{"type":39,"tag":72,"props":223,"children":225},{"className":224},[],[226],{"type":45,"value":227},"..\u002Fsecurity-scan\u002Freferences\u002Frepository-wide-scan.md",{"type":45,"value":229}," and every required reference it lists.",{"type":39,"tag":48,"props":231,"children":233},{"id":232},"discovery-checklist",[234],{"type":45,"value":235},"Discovery Checklist",{"type":39,"tag":55,"props":237,"children":238},{},[239],{"type":45,"value":240},"Use this checklist to keep discovery specific without turning it into validation or attack-path analysis:",{"type":39,"tag":112,"props":242,"children":243},{},[244,249,254,259,264,269,274,279,298,303,308,313,318,323,328,333,338,394,399,404,409,414,419,424,429,434,477,482,487,492,497,525,538,543,548,553,558,571,576,625,646,651,656,661,666,671,676,681,686,706,719,732,808,813,818,831,836],{"type":39,"tag":116,"props":245,"children":246},{},[247],{"type":45,"value":248},"Use tools to inspect the changed files and the minimum supporting files they rely on before deciding anything.",{"type":39,"tag":116,"props":250,"children":251},{},[252],{"type":45,"value":253},"Treat the commit message and title as potentially incomplete or misleading; trust the actual code path more than the narrative.",{"type":39,"tag":116,"props":255,"children":256},{},[257],{"type":45,"value":258},"Follow the entire changed-code chain far enough to understand how the diff affects authorization, trust boundaries, dangerous sinks, or security controls.",{"type":39,"tag":116,"props":260,"children":261},{},[262],{"type":45,"value":263},"Prefer multiple distinct finding families only when they come from different root causes; do not split one issue into cosmetic variants, but keep independently reachable instances as separate candidate entries.",{"type":39,"tag":116,"props":265,"children":266},{},[267],{"type":45,"value":268},"When the diff changes a shared helper, guard, route pattern, template pattern, or sink wrapper, expand to sibling call sites that the changed code directly affects, and keep each vulnerable instance addressable.",{"type":39,"tag":116,"props":270,"children":271},{},[272],{"type":45,"value":273},"Look for attacker-controlled input, broken enforcement, or dangerous sinks introduced or made reachable by the change.",{"type":39,"tag":116,"props":275,"children":276},{},[277],{"type":45,"value":278},"Stay anchored to the diff and the supporting files it depends on rather than drifting into unrelated repository scanning.",{"type":39,"tag":116,"props":280,"children":281},{},[282,284,289,291,296],{"type":45,"value":283},"For repository-wide and scoped-path scans, stay anchored to ",{"type":39,"tag":72,"props":285,"children":287},{"className":286},[],[288],{"type":45,"value":137},{"type":45,"value":290},", ",{"type":39,"tag":72,"props":292,"children":294},{"className":293},[],[295],{"type":45,"value":166},{"type":45,"value":297},", the runtime inventory, and the coverage ledger rather than drifting into arbitrary text search.",{"type":39,"tag":116,"props":299,"children":300},{},[301],{"type":45,"value":302},"For advisory-seeded repository-wide and scoped-path scans, keep any supplied advisory row id, exact file, line, source, sink, or broken-control hint visible in the candidate ledger. A neighboring same-CWE finding can be an additional candidate, but it does not satisfy the seeded row unless it covers the same vulnerable control and effect.",{"type":39,"tag":116,"props":304,"children":305},{},[306],{"type":45,"value":307},"Do not group many vulnerable files under one candidate when the files have separate line-level source\u002Fsink\u002Fcontrol evidence.",{"type":39,"tag":116,"props":309,"children":310},{},[311],{"type":45,"value":312},"When a dangerous sink has multiple call sites, enumerate each call site with its own source and closest control.",{"type":39,"tag":116,"props":314,"children":315},{},[316],{"type":45,"value":317},"When repeated templates, query builders, parser operations, auth\u002Fobject endpoints, or shared-helper callers are independently reachable, keep each vulnerable file and sink\u002Fcontrol line as its own candidate instance even if the final report later groups related prose.",{"type":39,"tag":116,"props":319,"children":320},{},[321],{"type":45,"value":322},"When source\u002Fsink evidence crosses a wrapper into a shared sink\u002Fcontrol helper, include both locations in the candidate so validation can test reachability without losing the root vulnerable line.",{"type":39,"tag":116,"props":324,"children":325},{},[326],{"type":45,"value":327},"When a concrete operation, strategy, converter, validator, or handler subclass selects the attacker-controlled operation semantics and delegates into a shared broken control or sink, include that subclass method or constructor as an affected candidate location alongside the shared helper. Do not replace it with only the abstract base class or shared helper.",{"type":39,"tag":116,"props":329,"children":330},{},[331],{"type":45,"value":332},"If a candidate claim says that a shared parser, loader, evaluator, auth guard, or operation family affects \"all\", \"every\", or \"any\" concrete implementation, enumerate the concrete implementations that make that claim true. Do not leave concrete vulnerable classes only in prose.",{"type":39,"tag":116,"props":334,"children":335},{},[336],{"type":45,"value":337},"When a broad candidate bucket names a whole operation family such as \"all SQL trigger variants\", \"all deserialization variants\", \"all path traversal helpers\", \"all SSRF modes\", \"all generated framework adapters\", or \"all unauthenticated mutation endpoints\", expand it into child candidates keyed by the concrete exported function, route branch, sink statement, API mode, parser\u002Fdeserializer variant, or protected action before handing the set to validation.",{"type":39,"tag":116,"props":339,"children":340},{},[341,343,349,351,357,358,364,365,371,372,378,379,385,386,392],{"type":45,"value":342},"If one route or helper exposes multiple dangerous operations in the same family, such as ",{"type":39,"tag":72,"props":344,"children":346},{"className":345},[],[347],{"type":45,"value":348},"execute",{"type":45,"value":350},"\u002F",{"type":39,"tag":72,"props":352,"children":354},{"className":353},[],[355],{"type":45,"value":356},"executemany",{"type":45,"value":350},{"type":39,"tag":72,"props":359,"children":361},{"className":360},[],[362],{"type":45,"value":363},"executescript",{"type":45,"value":290},{"type":39,"tag":72,"props":366,"children":368},{"className":367},[],[369],{"type":45,"value":370},"pickle.load",{"type":45,"value":350},{"type":39,"tag":72,"props":373,"children":375},{"className":374},[],[376],{"type":45,"value":377},"pickle.loads",{"type":45,"value":350},{"type":39,"tag":72,"props":380,"children":382},{"className":381},[],[383],{"type":45,"value":384},"yaml.load",{"type":45,"value":350},{"type":39,"tag":72,"props":387,"children":389},{"className":388},[],[390],{"type":45,"value":391},"yaml.load_all",{"type":45,"value":393},", separate path\u002Ffile helper methods, insert\u002Fselect\u002Fdelete\u002Fupdate query builders, or create\u002Fdelete\u002Freset\u002Fadmin\u002Fjob actions without auth, keep those operations as separate candidate instances when attackers can trigger them independently.",{"type":39,"tag":116,"props":395,"children":396},{},[397],{"type":45,"value":398},"Treat shared or generated wrappers as reachability evidence, not as a reason to collapse child sink variants. The wrapper can be a shared affected location, but each independent sink, control, or protected action still needs its own candidate id.",{"type":39,"tag":116,"props":400,"children":401},{},[402],{"type":45,"value":403},"When the scan context or evidence seeds a specific boundary package, class family, or vulnerability family, keep that seeded row open until that exact package or class family is closed. A nearby same-family finding is supporting context, not a replacement for the seeded root control.",{"type":39,"tag":116,"props":405,"children":406},{},[407],{"type":45,"value":408},"When CVE, GHSA, advisory, release, issue, or package-version context is provided, use any advisory seed research artifact as discovery input. Preserve seed-researched files\u002Ffunctions\u002Fclasses\u002Fhunks as ledger rows until local code evidence closes them as reportable, suppressed, not applicable, or deferred.",{"type":39,"tag":116,"props":410,"children":411},{},[412],{"type":45,"value":413},"When CVE\u002Fadvisory context has a generic or unhelpful category, do not fall back directly to broad hotspot findings. First derive a seed shortlist from advisory\u002Ffix\u002Frelease\u002Fsecurity-test sources when available; if that is unavailable, run a local regression-seed pass over project-specific protocol, parser, validator, utility, and version\u002Fcomparison helpers plus the CVE\u002Fadvisory terms.",{"type":39,"tag":116,"props":415,"children":416},{},[417],{"type":45,"value":418},"If discovery opens or greps a seed-target file, class, package, or hunk, create an explicit closure row for it. Do not leave the exact seed only in tool output, background context, or suppressed-candidate prose. If a broader sibling finding shares the same proof tuple, keep the seed anchor file\u002Fline as an affected location; otherwise close the seed row separately.",{"type":39,"tag":116,"props":420,"children":421},{},[422],{"type":45,"value":423},"For advisory-led rows, do not replace the exact seeded construct with a neighboring hotspot just because the neighboring issue is easier to exploit or validate. Keep the seeded row open until local repository evidence independently supports or disproves the same source, broken control, and impact tuple.",{"type":39,"tag":116,"props":425,"children":426},{},[427],{"type":45,"value":428},"For shared deserialization, class-resolution, template, and auth controls, treat the resolver\u002Ffilter\u002Fallowlist\u002Fdenylist\u002Fguard line as a candidate location when downstream transports or callers prove reachability. Do not anchor only on the more dramatic transport if the broken control is reusable.",{"type":39,"tag":116,"props":430,"children":431},{},[432],{"type":45,"value":433},"For deserialization and object-construction families, enumerate concrete codec, deserializer, converter, and container handlers registered by the parser or serialization config, including array, collection, map, bean, enum, throwable, and generic-object handlers. A top-level parser\u002Fconfig finding does not close a concrete codec row when that codec recursively invokes parsing, type resolution, conversion, or object construction on attacker-controlled data.",{"type":39,"tag":116,"props":435,"children":436},{},[437,439,445,446,452,453,459,461,467,469,475],{"type":45,"value":438},"For file-format object models, enumerate primitive\u002Fcontainer helper methods that convert or traverse attacker-controlled document structures, including ",{"type":39,"tag":72,"props":440,"children":442},{"className":441},[],[443],{"type":45,"value":444},"to*Array",{"type":45,"value":290},{"type":39,"tag":72,"props":447,"children":449},{"className":448},[],[450],{"type":45,"value":451},"get*",{"type":45,"value":290},{"type":39,"tag":72,"props":454,"children":456},{"className":455},[],[457],{"type":45,"value":458},"getObject",{"type":45,"value":460},", numeric conversion, ",{"type":39,"tag":72,"props":462,"children":464},{"className":463},[],[465],{"type":45,"value":466},"parse*",{"type":45,"value":468},", iterator, ",{"type":39,"tag":72,"props":470,"children":472},{"className":471},[],[473],{"type":45,"value":474},"size",{"type":45,"value":476},", unchecked casts, and allocation loops. Treat these helpers as candidate root controls when malformed documents can trigger type confusion, exceptions, unbounded traversal, or memory\u002FCPU exhaustion.",{"type":39,"tag":116,"props":478,"children":479},{},[480],{"type":45,"value":481},"If the repository-wide worklist or coverage ledger identifies a central object-model package for an untrusted format, include that package's array, dictionary, node, collection, and primitive conversion helpers as discovery rows before closing the parser family. A parser, filter, or codec finding in a neighboring package does not close unchecked conversion helpers in the core object model.",{"type":39,"tag":116,"props":483,"children":484},{},[485],{"type":45,"value":486},"Object-model helper sweeps create mandatory discovery rows first, not automatic reportable findings. Promote them only when malformed or adversarial input plausibly reaches the helper and the missing type, size, shape, recursion, numeric, or conversion guard can cause crash, denial of service, parser confusion, authorization bypass, or another concrete security impact.",{"type":39,"tag":116,"props":488,"children":489},{},[490],{"type":45,"value":491},"Do not suppress deterministic parser\u002Fhelper crashes as mere robustness when untrusted remote, protocol, document, archive, or package input can reach the missing guard and abort a service, request worker, parser pipeline, or security negotiation. Suppression needs exact containment evidence such as caller-side recovery, input prevalidation equivalent to the missing guard, or a non-security-only boundary.",{"type":39,"tag":116,"props":493,"children":494},{},[495],{"type":45,"value":496},"For structured patch\u002Fedit\u002Fapply APIs such as JSON Patch, Graph Patch, document edits, or config mutations, enumerate concrete request-selected operations like add, remove, replace, move, copy, and test. Keep operation-specific path transforms, array append handling, wildcard selection, or object-binding lines candidate-visible when they feed a shared evaluator or binder.",{"type":39,"tag":116,"props":498,"children":499},{},[500,502,508,509,515,517,523],{"type":45,"value":501},"In concrete operation classes, inspect specialized helper methods and not only the top-level ",{"type":39,"tag":72,"props":503,"children":505},{"className":504},[],[506],{"type":45,"value":507},"perform",{"type":45,"value":290},{"type":39,"tag":72,"props":510,"children":512},{"className":511},[],[513],{"type":45,"value":514},"handle",{"type":45,"value":516},", or ",{"type":39,"tag":72,"props":518,"children":520},{"className":519},[],[521],{"type":45,"value":522},"apply",{"type":45,"value":524}," override. If the operation-specific helper splits, filters, canonicalizes, or rebuilds attacker-controlled paths before delegating to a shared evaluator or binder, use that helper line as the candidate root control.",{"type":39,"tag":116,"props":526,"children":527},{},[528,530,536],{"type":45,"value":529},"When a concrete operation has special-case branches such as append, wildcard, fallback, copy\u002Fmove ",{"type":39,"tag":72,"props":531,"children":533},{"className":532},[],[534],{"type":45,"value":535},"from",{"type":45,"value":537},", default-value, or type-resolution paths, keep the branch predicate and branch-local transform lines as affected locations when they bypass or narrow the shared validator. A shared helper finding does not close branch-specific root controls.",{"type":39,"tag":116,"props":539,"children":540},{},[541],{"type":45,"value":542},"When class-filter, allowlist, denylist, blacklist, whitelist, or resolver logic is duplicated across core, server, client, remoting, plugin, or import packages, include the runtime\u002Fexported equivalents as candidate locations when they implement the same broken control. A transport callsite proves reachability, but it does not replace the reusable resolver implementation.",{"type":39,"tag":116,"props":544,"children":545},{},[546],{"type":45,"value":547},"In framework or library scans, stored client, tenant, application, identity-provider, exception, or imported-configuration values are cross-boundary inputs when later rendered, evaluated, parsed, or used for authorization and the instance has a plausible runtime path from an application, tenant, identity provider, import, or other boundary. Do not suppress solely because the writer is outside the current repository unless repository evidence proves the value is trusted-only for normal deployments.",{"type":39,"tag":116,"props":549,"children":550},{},[551],{"type":45,"value":552},"For SQL\u002FNoSQL\u002FLDAP\u002FXPath and similar query APIs, do not suppress a candidate solely because the endpoint already accepts user-controlled data, because the operation is an insert\u002Fupdate, or because a later business check appears to limit the final application effect. If attacker-controlled input reaches query syntax or selector operators through a plausible runtime path, carry the candidate to validation with the later check recorded as possible counterevidence.",{"type":39,"tag":116,"props":554,"children":555},{},[556],{"type":45,"value":557},"Do not collapse separate high-impact proof tuples into one candidate only because they share a route or helper. Split command execution, SSRF, path\u002Ffile impact, XML\u002Fparser behavior, XSS\u002Ftemplate execution, and authz\u002Fstate-change impact when the sink, closest control, or impact differs.",{"type":39,"tag":116,"props":559,"children":560},{},[561,563,569],{"type":45,"value":562},"For outbound request surfaces such as ",{"type":39,"tag":72,"props":564,"children":566},{"className":565},[],[567],{"type":45,"value":568},"downloadFrom",{"type":45,"value":570},", URL importers, webhook\u002Fcallback clients, preview\u002Frender fetchers, and redirect-following HTTP clients, enumerate each attacker-controlled destination source and its closest allow\u002Fdeny\u002Ffilter\u002Fredirect control. Do not suppress SSRF because the fetch\u002Fcallback is an intended feature, because filters are optional or empty by default, or because a sibling route found a louder file\u002Fpath issue; keep the network row when user input can select a destination and the hard boundary is incomplete, operator-configured, or only pre-request.",{"type":39,"tag":116,"props":572,"children":573},{},[574],{"type":45,"value":575},"In XML\u002Fparser\u002Fdeserializer surfaces, enumerate default parser factories, converters, validators, transformers, unmarshal\u002Fparse calls, and handler entrypoints independently. A safe sibling parser path is negative control for that sibling, not suppression evidence for a different default factory or converter.",{"type":39,"tag":116,"props":577,"children":578},{},[579,581,587,588,594,595,601,603,609,610,616,617,623],{"type":45,"value":580},"For command\u002Faction runners, enumerate every attacker-controllable argument type and execution mode before closing command-injection coverage. Treat type-safety maps, unsafe-type denylists, template substitution, shell wrapping, direct-exec branches, webhook\u002FAPI argument ingestion, and frontend-only widget constraints as separate controls. A denylist that covers ",{"type":39,"tag":72,"props":582,"children":584},{"className":583},[],[585],{"type":45,"value":586},"raw",{"type":45,"value":290},{"type":39,"tag":72,"props":589,"children":591},{"className":590},[],[592],{"type":45,"value":593},"url",{"type":45,"value":516},{"type":39,"tag":72,"props":596,"children":598},{"className":597},[],[599],{"type":45,"value":600},"email",{"type":45,"value":602}," does not close ",{"type":39,"tag":72,"props":604,"children":606},{"className":605},[],[607],{"type":45,"value":608},"password",{"type":45,"value":290},{"type":39,"tag":72,"props":611,"children":613},{"className":612},[],[614],{"type":45,"value":615},"checkbox",{"type":45,"value":290},{"type":39,"tag":72,"props":618,"children":620},{"className":619},[],[621],{"type":45,"value":622},"confirmation",{"type":45,"value":624},", choice, or other nil\u002Fno-op typecheck branches that can still render into shell commands.",{"type":39,"tag":116,"props":626,"children":627},{},[628,630,636,638,644],{"type":45,"value":629},"For XML parser and converter candidates, include feature-setup and resolver lines when hardening is best-effort, fail-open, or incomplete. ",{"type":39,"tag":72,"props":631,"children":633},{"className":632},[],[634],{"type":45,"value":635},"FEATURE_SECURE_PROCESSING",{"type":45,"value":637}," alone, swallowed\u002Flogged ",{"type":39,"tag":72,"props":639,"children":641},{"className":640},[],[642],{"type":45,"value":643},"setFeature",{"type":45,"value":645}," failures, or a safe default parser does not suppress caller-supplied parser factories\u002Freaders or converter paths that create SAX\u002FDOM\u002FStAX\u002FTransformer sources from untrusted data.",{"type":39,"tag":116,"props":647,"children":648},{},[649],{"type":45,"value":650},"For resource-serving and static-file paths, include the allowlist, matcher, canonicalization, URL decoding, and resource-selection line that decides whether an attacker-chosen path is allowed. Do not replace a vulnerable legacy or package API handler with a safer sibling handler. For restore\u002Fimport\u002Fexport, backup, admin, or login-named routes, also verify the exact global middleware and decorator semantics before assuming authentication is required; optional or conditional login wrappers keep the route anonymous when the enabling auth configuration is absent.",{"type":39,"tag":116,"props":652,"children":653},{},[654],{"type":45,"value":655},"For path-sensitive filesystem families, enumerate concrete exported operations for restore\u002Fimport\u002Fexport, backup\u002Frestore, archive extraction, file copy\u002Fmove, download\u002Fopen, and key\u002Fconfig fetch helpers. Keep decode, join, normalize, canonicalize, strip-prefix, extension-check, and destination-selection lines candidate-visible for each independently reachable operation.",{"type":39,"tag":116,"props":657,"children":658},{},[659],{"type":45,"value":660},"For archive extraction and restore\u002Fimport flows, keep the archive-member name, destination join, containment check, and extract\u002Fwrite call visible as candidate root controls. Do not replace them with a later copy, import, UUID\u002Fmanifest gate, or top-level file-selection step if extraction or filesystem writes already happened first. Generic claims that a standard-library helper normalizes paths are not enough; keep the row open until the code shows exact per-entry containment before extraction or write, including any symlink, hardlink, metadata, or recursive-copy path that could later promote attacker-controlled content into an imported subtree. Do not require the write to escape the overall app\u002Fdatastore root; overwriting trusted config, peer-object directories, shared roots, or imported subtrees inside that root still counts as file-impact.",{"type":39,"tag":116,"props":662,"children":663},{},[664],{"type":45,"value":665},"When upload\u002Farchive-member rows have a precise source to decoded\u002Ffiltered member name to destination join\u002Fwrite tuple, keep them as candidates even if runtime package reproduction is unavailable or confidence is medium. A cleaner download\u002Fopen traversal or API\u002Fauth issue in the same repository is not a reason to drop the archive-member row; report the archive row at calibrated severity\u002Fconfidence or keep an explicit deferred ledger row with the missing proof.",{"type":39,"tag":116,"props":667,"children":668},{},[669],{"type":45,"value":670},"When the same product area also has auth, secret, or configuration bugs, keep the path\u002Ffile candidate open until its own proof tuple is closed. Do not replace it with the louder neighboring issue.",{"type":39,"tag":116,"props":672,"children":673},{},[674],{"type":45,"value":675},"In framework or library scans, do not suppress a high-impact candidate solely because the affected API is deprecated, opt-in, or documented as dangerous. State that as a precondition; keep the candidate when the shipped runtime code contains a bypassable control in the restricted or normal usage path and the instance has a plausible cross-boundary source and runtime\u002Fdeployment path.",{"type":39,"tag":116,"props":677,"children":678},{},[679],{"type":45,"value":680},"In auth\u002Fauthz surfaces, enumerate public webhook, status, callback, and API endpoints that read protected objects, trigger builds\u002Fjobs, or mutate protected state independently from nearby credential or configuration bugs.",{"type":39,"tag":116,"props":682,"children":683},{},[684],{"type":45,"value":685},"For stateful authentication protocols, include the line that installs or reuses principals, credentials, tokens, issuers, or protocol state after a pre-authentication, TLS-upgrade, redirect, assertion, or identity-provider transition. Missing rebind\u002Freauthentication or validated-vs-consumed mismatches are candidate controls when they can authenticate the wrong identity.",{"type":39,"tag":116,"props":687,"children":688},{},[689,691,697,698,704],{"type":45,"value":690},"In SSO\u002FSAML\u002Ffederation packages, keep response\u002Fassertion validators distinct from generic claims authorizers and service-method authorization. Include assertion selection, list indexing, ",{"type":39,"tag":72,"props":692,"children":694},{"className":693},[],[695],{"type":45,"value":696},"getDOM",{"type":45,"value":290},{"type":39,"tag":72,"props":699,"children":701},{"className":700},[],[702],{"type":45,"value":703},"cloneNode",{"type":45,"value":705},", signed-object lookup, subject confirmation, recipient, audience, destination, ACS URL, and issuer-binding lines when they decide which assertion is trusted or returned.",{"type":39,"tag":116,"props":707,"children":708},{},[709,711,717],{"type":45,"value":710},"In auth\u002Ftoken\u002Fassertion validators, watch for a validation loop or ",{"type":39,"tag":72,"props":712,"children":714},{"className":713},[],[715],{"type":45,"value":716},"foundValid*",{"type":45,"value":718}," flag followed by a separate fixed-index, first\u002Flast-element, clone, serialization, or return path. Treat the later object-selection line as the broken control until exact counterevidence proves the validated object and consumed object are identical and equally bound.",{"type":39,"tag":116,"props":720,"children":721},{},[722,724,730],{"type":45,"value":723},"For realm\u002Fauthenticator packages, enumerate concrete implementations such as LDAP, Kerberos, PAM, SAML, OAuth\u002FOIDC, or custom ",{"type":39,"tag":72,"props":725,"children":727},{"className":726},[],[728],{"type":45,"value":729},"Realm",{"type":45,"value":731}," classes before promoting a nearby generic HTTP auth finding. In TLS-upgraded or multi-step binds, keep the bind\u002Frebind and principal\u002Fcredential installation line candidate-visible.",{"type":39,"tag":116,"props":733,"children":734},{},[735,737,743,744,750,751,757,758,764,765,771,772,778,779,785,786,792,793,799,800,806],{"type":45,"value":736},"In protocol-heavy repositories, inspect low-level version, capability, feature, and negotiation utility classes even if the most obvious candidates are REST\u002Fupload\u002Fadmin hotspots. Search for helper names such as ",{"type":39,"tag":72,"props":738,"children":740},{"className":739},[],[741],{"type":45,"value":742},"Version",{"type":45,"value":290},{"type":39,"tag":72,"props":745,"children":747},{"className":746},[],[748],{"type":45,"value":749},"VersionUtil",{"type":45,"value":290},{"type":39,"tag":72,"props":752,"children":754},{"className":753},[],[755],{"type":45,"value":756},"versionCompare",{"type":45,"value":290},{"type":39,"tag":72,"props":759,"children":761},{"className":760},[],[762],{"type":45,"value":763},"versionMatch",{"type":45,"value":290},{"type":39,"tag":72,"props":766,"children":768},{"className":767},[],[769],{"type":45,"value":770},"Capability",{"type":45,"value":290},{"type":39,"tag":72,"props":773,"children":775},{"className":774},[],[776],{"type":45,"value":777},"Feature",{"type":45,"value":290},{"type":39,"tag":72,"props":780,"children":782},{"className":781},[],[783],{"type":45,"value":784},"Negotiation",{"type":45,"value":290},{"type":39,"tag":72,"props":787,"children":789},{"className":788},[],[790],{"type":45,"value":791},"parseInt",{"type":45,"value":290},{"type":39,"tag":72,"props":794,"children":796},{"className":795},[],[797],{"type":45,"value":798},"split",{"type":45,"value":290},{"type":39,"tag":72,"props":801,"children":803},{"className":802},[],[804],{"type":45,"value":805},"matches",{"type":45,"value":807},", and comparator methods, then close paired validator\u002Fparser rows explicitly.",{"type":39,"tag":116,"props":809,"children":810},{},[811],{"type":45,"value":812},"For self-service update routes, include guard or predicate methods that compare requested objects against persisted objects. Treat missing checks on security-sensitive scalar fields and collection aliases as candidate locations when they can change identity, trust state, tenant membership, roles, groups, or account recovery properties.",{"type":39,"tag":116,"props":814,"children":815},{},[816],{"type":45,"value":817},"When a template or config pattern appears repeatedly, enumerate each affected file\u002Fline and note any nearby safe control that should not be reported.",{"type":39,"tag":116,"props":819,"children":820},{},[821,823,829],{"type":45,"value":822},"For diff-scoped scans, include ",{"type":39,"tag":72,"props":824,"children":826},{"className":825},[],[827],{"type":45,"value":828},"relevant_lines",{"type":45,"value":830}," only when the bug overlaps the diff and those lines are genuinely relevant to the issue.",{"type":39,"tag":116,"props":832,"children":833},{},[834],{"type":45,"value":835},"For recursive placeholder or template findings, include the helper\u002Fparser setup line that enables recursive expansion or expression evaluation along with the resolver\u002Fevaluation\u002Frender line.",{"type":39,"tag":116,"props":837,"children":838},{},[839],{"type":45,"value":840},"Include CWE IDs when known; use an empty list when the class is unclear.",{"type":39,"tag":48,"props":842,"children":844},{"id":843},"finding-bar",[845],{"type":45,"value":846},"Finding Bar",{"type":39,"tag":55,"props":848,"children":849},{},[850],{"type":45,"value":851},"Prefer technically plausible candidates such as:",{"type":39,"tag":112,"props":853,"children":854},{},[855,860,865,870,875,880,885,890],{"type":39,"tag":116,"props":856,"children":857},{},[858],{"type":45,"value":859},"authz bypass",{"type":39,"tag":116,"props":861,"children":862},{},[863],{"type":45,"value":864},"confused deputy",{"type":39,"tag":116,"props":866,"children":867},{},[868],{"type":45,"value":869},"SSRF",{"type":39,"tag":116,"props":871,"children":872},{},[873],{"type":45,"value":874},"path traversal",{"type":39,"tag":116,"props":876,"children":877},{},[878],{"type":45,"value":879},"injection with a real sink",{"type":39,"tag":116,"props":881,"children":882},{},[883],{"type":45,"value":884},"cross-tenant data exposure",{"type":39,"tag":116,"props":886,"children":887},{},[888],{"type":45,"value":889},"sensitive state change without correct enforcement",{"type":39,"tag":116,"props":891,"children":892},{},[893],{"type":45,"value":894},"sandbox or trust-boundary escape",{"type":39,"tag":55,"props":896,"children":897},{},[898,900,906],{"type":45,"value":899},"Discovery identifies plausible candidates and preserves their evidence; it does not own final severity calibration. For reportability and severity examples, defer to ",{"type":39,"tag":72,"props":901,"children":903},{"className":902},[],[904],{"type":45,"value":905},"..\u002Fattack-path-analysis\u002Freferences\u002Fseverity-policy.md",{"type":45,"value":907}," during attack-path analysis.",{"type":39,"tag":55,"props":909,"children":910},{},[911],{"type":45,"value":912},"Avoid:",{"type":39,"tag":112,"props":914,"children":915},{},[916,921,926],{"type":39,"tag":116,"props":917,"children":918},{},[919],{"type":45,"value":920},"generic \"needs more validation\" comments with no exploit path",{"type":39,"tag":116,"props":922,"children":923},{},[924],{"type":45,"value":925},"maintainability complaints",{"type":39,"tag":116,"props":927,"children":928},{},[929],{"type":45,"value":930},"duplicate variants of the same root issue",{"type":39,"tag":48,"props":932,"children":934},{"id":933},"output-contract",[935],{"type":45,"value":936},"Output Contract",{"type":39,"tag":55,"props":938,"children":939},{},[940],{"type":45,"value":941},"If there are no plausible candidates, return a no-findings result.",{"type":39,"tag":55,"props":943,"children":944},{},[945],{"type":45,"value":946},"Otherwise, for each candidate include:",{"type":39,"tag":112,"props":948,"children":949},{},[950,955,960,993,1006,1011,1016,1021,1026,1031,1036,1041,1046,1056,1061],{"type":39,"tag":116,"props":951,"children":952},{},[953],{"type":45,"value":954},"candidate id",{"type":39,"tag":116,"props":956,"children":957},{},[958],{"type":45,"value":959},"title",{"type":39,"tag":116,"props":961,"children":962},{},[963,965,971,972,978,979,985,987],{"type":45,"value":964},"affected locations, with labels when more than one applies: ",{"type":39,"tag":72,"props":966,"children":968},{"className":967},[],[969],{"type":45,"value":970},"entrypoint\u002Fwrapper",{"type":45,"value":290},{"type":39,"tag":72,"props":973,"children":975},{"className":974},[],[976],{"type":45,"value":977},"root_control",{"type":45,"value":290},{"type":39,"tag":72,"props":980,"children":982},{"className":981},[],[983],{"type":45,"value":984},"sink",{"type":45,"value":986},", and ",{"type":39,"tag":72,"props":988,"children":990},{"className":989},[],[991],{"type":45,"value":992},"concrete_implementation",{"type":39,"tag":116,"props":994,"children":995},{},[996,998,1004],{"type":45,"value":997},"instance key in the form ",{"type":39,"tag":72,"props":999,"children":1001},{"className":1000},[],[1002],{"type":45,"value":1003},"\u003Cfamily>:\u003Cfile>:\u003Cline>",{"type":45,"value":1005}," for repository-wide and scoped-path scans",{"type":39,"tag":116,"props":1007,"children":1008},{},[1009],{"type":45,"value":1010},"seed or ledger row id for repository-wide and scoped-path seeded\u002Froot-control rows when available",{"type":39,"tag":116,"props":1012,"children":1013},{},[1014],{"type":45,"value":1015},"advisory\u002Fsource reference for advisory-seeded rows when available",{"type":39,"tag":116,"props":1017,"children":1018},{},[1019],{"type":45,"value":1020},"attacker-controlled source",{"type":39,"tag":116,"props":1022,"children":1023},{},[1024],{"type":45,"value":1025},"vulnerable sink or broken control",{"type":39,"tag":116,"props":1027,"children":1028},{},[1029],{"type":45,"value":1030},"impact",{"type":39,"tag":116,"props":1032,"children":1033},{},[1034],{"type":45,"value":1035},"why the issue is plausible from the current code",{"type":39,"tag":116,"props":1037,"children":1038},{},[1039],{"type":45,"value":1040},"closest apparent control and why it is absent, bypassed, mis-scoped, or incomplete",{"type":39,"tag":116,"props":1042,"children":1043},{},[1044],{"type":45,"value":1045},"whether validation is recommended",{"type":39,"tag":116,"props":1047,"children":1048},{},[1049,1054],{"type":39,"tag":72,"props":1050,"children":1052},{"className":1051},[],[1053],{"type":45,"value":828},{"type":45,"value":1055}," for diff-scoped scans when the bug overlaps the diff and those lines are relevant to the bug",{"type":39,"tag":116,"props":1057,"children":1058},{},[1059],{"type":45,"value":1060},"taxonomy with CWE IDs when known",{"type":39,"tag":116,"props":1062,"children":1063},{},[1064],{"type":45,"value":1065},"enough evidence that a later reviewer can understand why the candidate is technically plausible before validation",{"type":39,"tag":55,"props":1067,"children":1068},{},[1069,1071,1076],{"type":45,"value":1070},"When candidates are emitted, create the per-finding directory from ",{"type":39,"tag":72,"props":1072,"children":1074},{"className":1073},[],[1075],{"type":45,"value":77},{"type":45,"value":1077}," and append one discovery receipt to that finding's candidate ledger. The ledger row should identify the candidate, scan scope, discovery status, affected locations, and the discovery artifact or evidence that produced it.",{"type":39,"tag":48,"props":1079,"children":1081},{"id":1080},"hard-rules",[1082],{"type":45,"value":1083},"Hard Rules",{"type":39,"tag":112,"props":1085,"children":1086},{},[1087,1092,1097,1102,1107,1119,1138,1143,1148],{"type":39,"tag":116,"props":1088,"children":1089},{},[1090],{"type":45,"value":1091},"Use the tools to examine repository files before making decisions.",{"type":39,"tag":116,"props":1093,"children":1094},{},[1095],{"type":45,"value":1096},"Focus on the actual changes, not the commit message.",{"type":39,"tag":116,"props":1098,"children":1099},{},[1100],{"type":45,"value":1101},"Stay anchored to the diff and the files it relies on for diff-scoped scans. For repository-wide and scoped-path scans, treat the resolved audit scope as in scope and ignore diff-overlap restrictions for affected locations.",{"type":39,"tag":116,"props":1103,"children":1104},{},[1105],{"type":45,"value":1106},"Candidate discovery is about plausibility, not final severity.",{"type":39,"tag":116,"props":1108,"children":1109},{},[1110,1112,1117],{"type":45,"value":1111},"Do not emit an untracked candidate. Every candidate finding needs a stable candidate id and a discovery receipt in its candidate-ledger path from ",{"type":39,"tag":72,"props":1113,"children":1115},{"className":1114},[],[1116],{"type":45,"value":77},{"type":45,"value":1118}," so later validation and attack-path analysis can prove coverage for that exact finding.",{"type":39,"tag":116,"props":1120,"children":1121},{},[1122,1124,1129,1131,1136],{"type":45,"value":1123},"Do not add ",{"type":39,"tag":72,"props":1125,"children":1127},{"className":1126},[],[1128],{"type":45,"value":828},{"type":45,"value":1130}," when no bug exists. For diff-scoped scans, add ",{"type":39,"tag":72,"props":1132,"children":1134},{"className":1133},[],[1135],{"type":45,"value":828},{"type":45,"value":1137}," only when the bug overlaps the diff and those lines are relevant to the bug.",{"type":39,"tag":116,"props":1139,"children":1140},{},[1141],{"type":45,"value":1142},"Do not turn discovery into full validation or full severity calibration.",{"type":39,"tag":116,"props":1144,"children":1145},{},[1146],{"type":45,"value":1147},"Continue reviewing until no additional distinct plausible candidates remain.",{"type":39,"tag":116,"props":1149,"children":1150},{},[1151,1153,1158],{"type":45,"value":1152},"Save a final visible report using the finding discovery report path from ",{"type":39,"tag":72,"props":1154,"children":1156},{"className":1155},[],[1157],{"type":45,"value":77},{"type":45,"value":79},{"items":1160,"total":1363},[1161,1182,1205,1222,1236,1255,1274,1290,1306,1320,1332,1347],{"slug":1162,"name":1162,"fn":1163,"description":1164,"org":1165,"tags":1166,"stars":1179,"repoUrl":1180,"updatedAt":1181},"prior-auth-packet-builder","build healthcare prior authorization packets","Build a concise prior authorization packet from local case files and payer policy docs.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1167,1170,1173,1176],{"name":1168,"slug":1169,"type":15},"Documents","documents",{"name":1171,"slug":1172,"type":15},"Healthcare","healthcare",{"name":1174,"slug":1175,"type":15},"Insurance","insurance",{"name":1177,"slug":1178,"type":15},"Regulatory Compliance","regulatory-compliance",28169,"https:\u002F\u002Fgithub.com\u002Fopenai\u002Fopenai-agents-python","2026-04-16T05:11:39.180399",{"slug":1183,"name":1183,"fn":1184,"description":1185,"org":1186,"tags":1187,"stars":1202,"repoUrl":1203,"updatedAt":1204},"aspnet-core","build ASP.NET Core web applications","Build, review, refactor, or architect ASP.NET Core web applications using current official guidance for .NET web development. Use when working on Blazor Web Apps, Razor Pages, MVC, Minimal APIs, controller-based Web APIs, SignalR, gRPC, middleware, dependency injection, configuration, authentication, authorization, testing, performance, deployment, or ASP.NET Core upgrades.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1188,1191,1193,1196,1199],{"name":1189,"slug":1190,"type":15},".NET","dotnet",{"name":1192,"slug":1183,"type":15},"ASP.NET Core",{"name":1194,"slug":1195,"type":15},"Blazor","blazor",{"name":1197,"slug":1198,"type":15},"C#","csharp",{"name":1200,"slug":1201,"type":15},"Web Development","web-development",23787,"https:\u002F\u002Fgithub.com\u002Fopenai\u002Fskills","2026-04-12T05:07:02.819491",{"slug":1206,"name":1206,"fn":1207,"description":1208,"org":1209,"tags":1210,"stars":1202,"repoUrl":1203,"updatedAt":1221},"chatgpt-apps","build ChatGPT Apps SDK applications","Build, scaffold, refactor, and troubleshoot ChatGPT Apps SDK applications that combine an MCP server and widget UI. Use when Codex needs to design tools, register UI resources, wire the MCP Apps bridge or ChatGPT compatibility APIs, apply Apps SDK metadata or CSP or domain settings, or produce a docs-aligned project scaffold. Prefer a docs-first workflow by invoking the openai-docs skill or OpenAI developer docs MCP tools before generating code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1211,1214,1217,1220],{"name":1212,"slug":1213,"type":15},"Apps SDK","apps-sdk",{"name":1215,"slug":1216,"type":15},"ChatGPT","chatgpt",{"name":1218,"slug":1219,"type":15},"MCP","mcp",{"name":9,"slug":8,"type":15},"2026-04-12T05:07:05.468097",{"slug":1223,"name":1223,"fn":1224,"description":1225,"org":1226,"tags":1227,"stars":1202,"repoUrl":1203,"updatedAt":1235},"cli-creator","build CLIs from API docs","Build a composable CLI for Codex from API docs, an OpenAPI spec, existing curl examples, an SDK, a web app, an admin tool, or a local script. Use when the user wants Codex to create a command-line tool that can run from any repo, expose composable read\u002Fwrite commands, return stable JSON, manage auth, and pair with a companion skill.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1228,1231,1234],{"name":1229,"slug":1230,"type":15},"API Development","api-development",{"name":1232,"slug":1233,"type":15},"CLI","cli",{"name":17,"slug":18,"type":15},"2026-04-12T05:07:04.132762",{"slug":1237,"name":1237,"fn":1238,"description":1239,"org":1240,"tags":1241,"stars":1202,"repoUrl":1203,"updatedAt":1254},"cloudflare-deploy","deploy projects to Cloudflare","Deploy applications and infrastructure to Cloudflare using Workers, Pages, and related platform services. Use when the user asks to deploy, host, publish, or set up a project on Cloudflare.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1242,1245,1248,1251],{"name":1243,"slug":1244,"type":15},"Cloudflare","cloudflare",{"name":1246,"slug":1247,"type":15},"Cloudflare Pages","cloudflare-pages",{"name":1249,"slug":1250,"type":15},"Cloudflare Workers","cloudflare-workers",{"name":1252,"slug":1253,"type":15},"Deployment","deployment","2026-04-12T05:07:14.275118",{"slug":1256,"name":1256,"fn":1257,"description":1258,"org":1259,"tags":1260,"stars":1202,"repoUrl":1203,"updatedAt":1273},"define-goal","define and set measurable project goals","Help the user define a concrete, measurable goal before starting work, especially when they ask to use the goal tool, create a goal, set an objective, clarify success criteria, or turn a fuzzy intention into a quantitative outcome. Use this skill for goal creation and goal refinement only; it does not manage durable snapshots, decision logs, or long-running execution artifacts.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1261,1264,1267,1270],{"name":1262,"slug":1263,"type":15},"Productivity","productivity",{"name":1265,"slug":1266,"type":15},"Project Management","project-management",{"name":1268,"slug":1269,"type":15},"Strategy","strategy",{"name":1271,"slug":1272,"type":15},"Task Management","task-management","2026-05-23T06:17:16.870838",{"slug":1275,"name":1275,"fn":1276,"description":1277,"org":1278,"tags":1279,"stars":1202,"repoUrl":1203,"updatedAt":1289},"figma","translate Figma designs into code","Use the Figma MCP server to fetch design context, screenshots, variables, and assets from Figma, and to translate Figma nodes into production code. Trigger when a task involves Figma URLs, node IDs, design-to-code implementation, or Figma MCP setup and troubleshooting.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1280,1283,1285,1288],{"name":1281,"slug":1282,"type":15},"Design","design",{"name":1284,"slug":1275,"type":15},"Figma",{"name":1286,"slug":1287,"type":15},"Frontend","frontend",{"name":1218,"slug":1219,"type":15},"2026-04-12T05:06:47.939943",{"slug":1291,"name":1291,"fn":1292,"description":1293,"org":1294,"tags":1295,"stars":1202,"repoUrl":1203,"updatedAt":1305},"figma-code-connect-components","connect Figma designs to code components","Connects Figma design components to code components using Code Connect mapping tools. Use when user says \"code connect\", \"connect this component to code\", \"map this component\", \"link component to code\", \"create code connect mapping\", or wants to establish mappings between Figma designs and code implementations. For canvas writes via `use_figma`, use `figma-use`.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1296,1297,1300,1301,1302],{"name":1281,"slug":1282,"type":15},{"name":1298,"slug":1299,"type":15},"Design System","design-system",{"name":1284,"slug":1275,"type":15},{"name":1286,"slug":1287,"type":15},{"name":1303,"slug":1304,"type":15},"UI Components","ui-components","2026-05-10T05:59:52.971881",{"slug":1307,"name":1307,"fn":1308,"description":1309,"org":1310,"tags":1311,"stars":1202,"repoUrl":1203,"updatedAt":1319},"figma-create-design-system-rules","generate design system rules from Figma","Generates custom design system rules for the user's codebase. Use when user says \"create design system rules\", \"generate rules for my project\", \"set up design rules\", \"customize design system guidelines\", or wants to establish project-specific conventions for Figma-to-code workflows. Requires Figma MCP server connection.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1312,1313,1314,1317,1318],{"name":1281,"slug":1282,"type":15},{"name":1298,"slug":1299,"type":15},{"name":1315,"slug":1316,"type":15},"Documentation","documentation",{"name":1284,"slug":1275,"type":15},{"name":1286,"slug":1287,"type":15},"2026-05-16T06:07:47.821474",{"slug":1321,"name":1321,"fn":1322,"description":1323,"org":1324,"tags":1325,"stars":1202,"repoUrl":1203,"updatedAt":1331},"figma-implement-design","translate Figma designs into application code","Translates Figma designs into production-ready application code with 1:1 visual fidelity. Use when implementing UI code from Figma files, when user mentions \"implement design\", \"generate code\", \"implement component\", provides Figma URLs, or asks to build components matching Figma specs. For Figma canvas writes via `use_figma`, use `figma-use`.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1326,1327,1328,1329,1330],{"name":1281,"slug":1282,"type":15},{"name":1284,"slug":1275,"type":15},{"name":1286,"slug":1287,"type":15},{"name":1303,"slug":1304,"type":15},{"name":1200,"slug":1201,"type":15},"2026-05-16T06:07:40.583615",{"slug":1333,"name":1333,"fn":1334,"description":1335,"org":1336,"tags":1337,"stars":1202,"repoUrl":1203,"updatedAt":1346},"hatch-pet","create animated pets for Codex","Create, repair, validate, visually QA, and package Codex-compatible animated pets and pet spritesheets from character art, generated images, company or prospect brand cues, or visual references. Use when a user wants a lightweight-worker Codex pet workflow, a non-pixel custom pet style, a prospect or company mascot pet, or a full 8x9 animated pet atlas with transparent unused cells, QA contact sheets, and pet.json packaging. This skill composes the installed $imagegen system skill for visual generation and uses bundled scripts for deterministic spritesheet assembly.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1338,1341,1342,1345],{"name":1339,"slug":1340,"type":15},"Animation","animation",{"name":17,"slug":18,"type":15},{"name":1343,"slug":1344,"type":15},"Creative","creative",{"name":1281,"slug":1282,"type":15},"2026-05-02T05:31:48.48485",{"slug":1348,"name":1348,"fn":1349,"description":1350,"org":1351,"tags":1352,"stars":1202,"repoUrl":1203,"updatedAt":1362},"imagegen","generate and edit raster images","Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output should be a bitmap asset rather than repo-native code or vector. Do not use when the task is better handled by editing existing SVG\u002Fvector\u002Fcode-native assets, extending an established icon or logo system, or building the visual directly in HTML\u002FCSS\u002Fcanvas.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1353,1354,1355,1358,1361],{"name":1343,"slug":1344,"type":15},{"name":1281,"slug":1282,"type":15},{"name":1356,"slug":1357,"type":15},"Image Generation","image-generation",{"name":1359,"slug":1360,"type":15},"Images","images",{"name":9,"slug":8,"type":15},"2026-05-15T06:23:24.312127",675,{"items":1365,"total":1479},[1366,1383,1399,1411,1429,1447,1467],{"slug":1367,"name":1367,"fn":1368,"description":1369,"org":1370,"tags":1371,"stars":22,"repoUrl":23,"updatedAt":1382},"accessibility-and-inclusive-visualization","make data visualizations accessible","Make data visualizations accessible and inclusive. Use when the user needs chart or diagram accessibility guidance, text alternatives for complex visuals, color and contrast review, keyboard support, reduced-motion behavior for animation or parallax, or an accessibility QA workflow for exported figures, UML-like diagrams, and dashboards.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1372,1375,1378,1381],{"name":1373,"slug":1374,"type":15},"Accessibility","accessibility",{"name":1376,"slug":1377,"type":15},"Charts","charts",{"name":1379,"slug":1380,"type":15},"Data Visualization","data-visualization",{"name":1281,"slug":1282,"type":15},"2026-06-30T19:00:57.102",{"slug":1384,"name":1384,"fn":1385,"description":1386,"org":1387,"tags":1388,"stars":22,"repoUrl":23,"updatedAt":1398},"agent-browser","automate browser interactions for agents","Browser automation CLI for AI agents. Use when the user needs to interact with websites, verify dev server output, test web apps, navigate pages, fill forms, click buttons, take screenshots, extract data, or automate any browser task. Also triggers when a dev server starts so you can verify it visually.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1389,1392,1395],{"name":1390,"slug":1391,"type":15},"Agents","agents",{"name":1393,"slug":1394,"type":15},"Browser Automation","browser-automation",{"name":1396,"slug":1397,"type":15},"Testing","testing","2026-04-06T18:41:03.44016",{"slug":1400,"name":1400,"fn":1401,"description":1402,"org":1403,"tags":1404,"stars":22,"repoUrl":23,"updatedAt":1410},"agent-browser-verify","verify dev server output with automated browser","Automated browser verification for dev servers. Triggers when a dev server starts to run a visual gut-check with agent-browser — verifies the page loads, checks for console errors, validates key UI elements, and reports pass\u002Ffail before continuing.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1405,1406,1409],{"name":1393,"slug":1394,"type":15},{"name":1407,"slug":1408,"type":15},"Local Development","local-development",{"name":1396,"slug":1397,"type":15},"2026-04-06T18:41:17.526867",{"slug":1412,"name":1412,"fn":1413,"description":1414,"org":1415,"tags":1416,"stars":22,"repoUrl":23,"updatedAt":1428},"agents-sdk","build AI agents on Cloudflare Workers","Build AI agents on Cloudflare Workers using the Agents SDK. Load when creating stateful agents, durable workflows, real-time WebSocket apps, scheduled tasks, MCP servers, or chat applications. Covers Agent class, state management, callable RPC, Workflows integration, and React hooks. Biases towards retrieval from Cloudflare docs over pre-trained knowledge.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1417,1418,1419,1422,1425],{"name":1390,"slug":1391,"type":15},{"name":1249,"slug":1250,"type":15},{"name":1420,"slug":1421,"type":15},"SDK","sdk",{"name":1423,"slug":1424,"type":15},"Serverless","serverless",{"name":1426,"slug":1427,"type":15},"WebSockets","websockets","2026-04-06T18:39:51.717063",{"slug":1430,"name":1430,"fn":1431,"description":1432,"org":1433,"tags":1434,"stars":22,"repoUrl":23,"updatedAt":1446},"ai-elements","build chat UIs with AI Elements","AI Elements component library guidance — pre-built React components for AI interfaces built on shadcn\u002Fui. Use when building chat UIs, message displays, tool call rendering, streaming responses, reasoning panels, or any AI-native interface with the AI SDK.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1435,1436,1439,1442,1443],{"name":1286,"slug":1287,"type":15},{"name":1437,"slug":1438,"type":15},"React","react",{"name":1440,"slug":1441,"type":15},"shadcn\u002Fui","shadcn-ui",{"name":1303,"slug":1304,"type":15},{"name":1444,"slug":1445,"type":15},"Vercel","vercel","2026-04-06T18:40:59.619419",{"slug":1448,"name":1448,"fn":1449,"description":1450,"org":1451,"tags":1452,"stars":22,"repoUrl":23,"updatedAt":1466},"ai-gateway","configure Vercel AI Gateway","Vercel AI Gateway expert guidance. Use when configuring model routing, provider failover, cost tracking, or managing multiple AI providers through a unified API.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1453,1456,1459,1462,1465],{"name":1454,"slug":1455,"type":15},"AI Infrastructure","ai-infrastructure",{"name":1457,"slug":1458,"type":15},"Cost Optimization","cost-optimization",{"name":1460,"slug":1461,"type":15},"LLM","llm",{"name":1463,"slug":1464,"type":15},"Performance","performance",{"name":1444,"slug":1445,"type":15},"2026-04-06T18:40:44.377464",{"slug":1468,"name":1468,"fn":1469,"description":1470,"org":1471,"tags":1472,"stars":22,"repoUrl":23,"updatedAt":1478},"ai-generation-persistence","implement persistence patterns for AI generations","AI generation persistence patterns — unique IDs, addressable URLs, database storage, and cost tracking for every LLM generation",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1473,1474,1477],{"name":1457,"slug":1458,"type":15},{"name":1475,"slug":1476,"type":15},"Database","database",{"name":1460,"slug":1461,"type":15},"2026-04-06T18:41:08.513425",600]