The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill uses prompt templates in references/verify-prompt.md and references/patch-prompt.md to instruct subagents during the verification and patching phases. These templates interpolate finding titles, descriptions, and code snippets directly from the repository being scanned. This creates an attack surface where a malicious file in the target codebase could influence subagent behavior by embedding instructions in findings generated by the scanner.
Ingestion points: Findings extracted from Warden logs in .warden/logs/ and stored in data/all-findings.jsonl and data/verified.jsonl.
Boundary markers: The prompt templates use markdown headers to structure data but lack explicit delimiters or instructions for the subagent to ignore potentially malicious content within the interpolated fields.
Capability inventory: Subagents are tasked with file reads and code modifications, while the main agent can execute git commands and create GitHub Pull Requests based on subagent output.
Sanitization: There is no evidence of sanitization or filtering of the findings data before it is interpolated into the subagent prompts.
[COMMAND_EXECUTION]: The skill relies on executing system commands such as git, gh (GitHub CLI), warden, and uv to automate the sweep process. These calls are implemented using Python's subprocess.run with argument lists rather than shell strings, which mitigates common command injection risks. These operations are essential to the primary function of the skill.
[EXTERNAL_DOWNLOADS]: The scripts/scan.py file declares a dependency on tomli, a widely-used and well-known Python library for TOML parsing, which is managed via the uv tool's script metadata.

warden-sweep