track-findingslisted

# Track Findings ## Objective Track findings from one sealed Codex Security scan as Linear issues, Jira issues, GitHub issues, or one draft GitHub security advisory. Do not change the scan bundle. Use one provider and one destination per run. Show the exact payload and get approval before writing. GitHub advisory mode creates one private draft in the verified public canonical source repository through authenticated `gh api --hostname github.com`. Read `references/github-security-advisories.md` in full before advisory work. Jira mode uses Atlassian Rovo to create, reuse, or update one Jira Cloud issue per selected finding. Use it for one finding or an explicitly selected batch of up to 25. Read `references/jira.md` in full before Jira work. ## Resources The tracking helper is at the plugin root: - `scripts/validate_tracking_source.py` This skill lives at `<plugin-root>/skills/track-findings/SKILL.md`, so `<plugin-root>` is two directories up. Do not look for the helper inside the skill directory. GitHub advisory mode is defined in: - `skills/track-findings/references/github-security-advisories.md` Jira mode is defined in: - `skills/track-findings/references/jira.md` Linear requires the native [$linear](app://asdk_app_69a089a326dc8191b32a3f2553f5be2c) app. Stop if it is unavailable or disconnected. Jira requires the native [$atlassian](app://connector_692de805e3ec8191834719067174a384) app. Reuse needs read access but not write access. Create and update need both.