fix(skills): limit fix-finding to security vulnerabilities

[tiffanycitra]

Summary

The fix-finding skill can be selected for ordinary review findings or general validation. Limit its selection guidance to requests to fix security vulnerabilities.

Changes

• Explicitly exclude ordinary bugs, correctness and design review findings, and general validation from the skill description.
• Rename the display label to Fix Security Finding.

Testing

• Skill and plugin validation passed.
• Plugin contract tests: 5 passed.
• Portable source compatibility check and its tests: passed, 9 tests. Used Node's TypeScript stripping to generate the ignored JavaScript checker files because the full build was unavailable.
• git diff --check: passed.
• Ruff lint and format checks could not run: installed version 0.16.1 differs from required 0.16.6.
• pnpm --dir sdk/typescript run build:ci could not run because Corepack's cache was read-only. No TypeScript type-check result is claimed.

Risk and rollout

Low-risk instruction and display-label change. The security remediation workflow and skill identifier remain unchanged. Distributed installs receive the change through the normal release process.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-14T03:06:56.215866Z	a06cb5b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.