Skills

.agents/skills/
└── find-warden-bugs/
    ├── SKILL.md          # Skill definition (required)
    ├── scripts/          # Helper scripts (optional)
    ├── references/       # Reference docs (optional)
    └── assets/          # Images, examples (optional)

.agents/skills/
└── find-warden-bugs.md   # Skill definition

---
name: find-warden-bugs
description: "Detects bugs at architectural seams using historical patterns"
allowed-tools: Read Grep Glob
---

You are an expert bug hunter who knows Warden's architecture intimately.

## Scope

You receive scoped code chunks from Warden's diff pipeline. Analyze each
chunk against the checks below.

## Checks

### Check 1: SDK Response Shape Assumptions

**Severity:** high | **Historical commits:** 5+

Claude SDK responses have a specific shape...

[More detailed prompt content]

---
name: security-audit
description: "Detects common security vulnerabilities"
allowed-tools: Read Grep
---

Analyze the code for:
- SQL injection risks
- XSS vulnerabilities
- Hardcoded credentials
...

---
name: test-coverage
description: "Ensures new code has tests"
allowed-tools: Read Glob Bash
---

For each new function:
1. Search for corresponding test files
2. Verify test coverage exists
3. Report if coverage is missing
...

---
name: readonly-analyzer
allowed-tools: Read Grep Glob
---

# .agents/skills/my-skill/scripts/analyze.sh
#!/bin/bash
grep -rn "TODO" src/

Run `./scripts/analyze.sh` to find TODO comments.

references/
├── api-spec.md
├── architecture.md
└── style-guide.md

Consult `references/style-guide.md` for naming conventions.

assets/
├── example-good.ts
└── example-bad.ts

[[skills]]
name = "code-simplifier"
remote = "getsentry/sentry-skills"

[[skills]]
name = "security-audit"
remote = "org/[email protected]"  # Pin to specific tag

[[skills]]
name = "find-warden-bugs"
paths = ["src/**/*.ts"]           # Only analyze TypeScript
ignorePaths = ["src/**/*.test.ts"] # Skip test files
failOn = "high"                    # Fail on high severity
reportOn = "medium"                # Show medium+
maxFindings = 50                   # Limit output
model = "claude-sonnet-4"          # Override model
maxTurns = 30                      # Limit API calls
minConfidence = "medium"           # Filter low confidence

[[skills.triggers]]
type = "pull_request"
actions = ["opened", "synchronize"]

export const SkillDefinitionSchema = z.object({
  name: z.string().min(1),
  description: z.string(),
  prompt: z.string(),
  tools: ToolConfigSchema.optional(),
  /** Directory where the skill was loaded from */
  rootDir: z.string().optional(),
});
export type SkillDefinition = z.infer<typeof SkillDefinitionSchema>;

export const ToolNameSchema = z.enum([
  'Read', 'Write', 'Edit', 'Bash',
  'Glob', 'Grep', 'WebFetch', 'WebSearch',
]);

export const ToolConfigSchema = z.object({
  allowed: z.array(ToolNameSchema).optional(),
  denied: z.array(ToolNameSchema).optional(),
});