Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.
Install
npx skills add openai/plugins --skill finding-discoverynpx skills add openai/plugins --skill finding-discovery -a claude-code -gnpx skills add openai/plugins --skill finding-discovery -a codex -ggemini skills install https://github.com/openai/plugins.git --path plugins/codex-security/skills/finding-discoverygh skill install openai/plugins finding-discoverygit clone --depth 1 https://github.com/openai/plugins /tmp/openai__plugins
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/openai__plugins/plugins/codex-security/skills/finding-discovery ~/.claude/skills/finding-discovery # Claude Code
cp -R /tmp/openai__plugins/plugins/codex-security/skills/finding-discovery ~/.agents/skills/finding-discovery # Codex, Cursor, Gemini CLI, Copilot, OpenCode