The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of system commands through the subprocess module to interact with git, gh (GitHub CLI), and warden. These operations are essential to the skill's primary function of scanning code and managing the development workflow (e.g., creating worktrees, branches, issues, and pull requests).
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface by ingesting findings generated from repository code (titles, descriptions, and code snippets) and interpolating them into templates for subagents in the verify-prompt.md and patch-prompt.md references. While this is a necessary part of the 'scan and fix' workflow, a maliciously crafted repository could attempt to influence subagent behavior through these findings.
Ingestion points: Findings extracted from warden logs in all-findings.jsonl (generated via scripts/scan.py and scripts/extract_findings.py).
Boundary markers: The skill uses named placeholders (e.g., ${DESCRIPTION}) within Markdown templates to delimit external content, which provides some structural separation but not full isolation.
Capability inventory: Subagents are granted capabilities to read/write files in the local worktree and execute git commands to stage and commit changes.
Sanitization: Content is interpolated directly into prompts without specific escaping or sanitization; however, the skill's structure and the use of the disable-model-invocation: true flag in the main manifest restrict the model to a defined sequence of steps.

warden-sweep