// Full-repository code sweep. Scans every file with Warden, verifies findings through deep tracing, creates draft PRs for validated issues. Use when asked to "sweep the repo", "scan everything", "find all bugs", "full codebase review", "batch code analysis", or run Warden across the entire repository.
Finds real correctness bugs in code changes. Use for adversarial code review, bug hunts, regression review, PR correctness review, logic errors, data loss, race conditions, state bugs, interface contract breaks, error handling bugs, edge cases, broken builds, or broken workflows. Excludes style, readability, architecture, AppSec, and best-practice-only feedback unless the issue causes a demonstrable bug.
Finds exploitable application security vulnerabilities in code changes. Use for Warden security scans, appsec review, OWASP-style checks, authentication or authorization bugs, injection, XSS, SSRF, path traversal, secrets, unsafe crypto, webhook verification, open redirects, or sensitive data exposure.
Run Warden to analyze code changes before committing. Use when asked to "run warden", "check my changes", "review before commit", "warden config", "warden.toml", "create a warden skill", "add trigger", or any Warden-related local development task.
Create, synthesize, and iteratively improve agent skills following the Agent Skills specification. Use when asked to "create a skill", "write a skill", "synthesize sources into a skill", "improve a skill from positive/negative examples", "update a skill", or "maintain skill docs and registration". Handles source capture, depth gates, authoring, registration, and validation.
Reference guide for writing effective agent prompts and skills. Use when creating new skills, reviewing prompt quality, or understanding Warden's prompt architecture.
Staff-level codebase health review. Finds monolithic modules, silent failures, type safety gaps, test coverage holes, and LLM-friendliness issues.
| name | warden-sweep |
| description | Full-repository code sweep. Scans every file with Warden, verifies findings through deep tracing, creates draft PRs for validated issues. Use when asked to "sweep the repo", "scan everything", "find all bugs", "full codebase review", "batch code analysis", or run Warden across the entire repository. |
| disable-model-invocation | true |
Run a full-repository Warden sweep: scan files, verify findings, create a tracking issue, open draft PRs for validated issues, and organize the final report.
Requires: warden, gh, git, jq, uv.
Run commands from the repository root. Use the host's skill-root path for bundled scripts and references.
Output goes to .warden/sweeps/<run-id>/.
Load only the reference for the current phase:
| Need | Read |
|---|---|
| Script arguments, outputs, and side effects | references/script-interfaces.md |
| Phase 1 scan workflow | references/scan-phase.md |
| Phase 2 verification workflow | references/verify-phase.md |
| Phase 3 tracking issue workflow | references/issue-phase.md |
| Phase 4 patch and draft PR workflow | references/patch-phase.md |
| Phase 5 organize and final report workflow | references/organize-phase.md |
| Resume behavior and artifact layout | references/resume-and-artifacts.md |
| Verification task prompt template | references/verify-prompt.md |
| Patch task prompt template | references/patch-prompt.md |
Track progress across phases:
references/script-interfaces.md once before running scripts.references/scan-phase.md. Save runId and sweepDir.references/verify-phase.md. Verify every finding before patching.references/issue-phase.md. Continue if issue creation fails.references/patch-phase.md. Patch sequentially, one finding at a time.references/organize-phase.md.references/resume-and-artifacts.md and continue from the first incomplete phase.After organizing, report:
## Sweep Complete
| Metric | Count |
|--------|-------|
| Files scanned | {filesScanned} |
| Findings verified | {verified} |
| PRs created | {prsCreated} |
| Security findings | {securityFindings} |
Full report: `{summaryPath}`