gator-gate

The referenced schema file is consumed via the skill's instruction to follow it, and the follow-up confirmed validate-review-findings and the sub-agent definition exist only outside consumed content while prompt.md is not in the repository, so every invoked definition remains unreviewable and no carve-out applies.

The reviewer output is routed through a validator whose implementation the follow-up confirmed is outside consumed content, and only its verdict may drive labels and public comments, so an unauditable binary gates public GitHub actions; the skill's assertion of what the validator sets is unverified description, not a mitigation.

The strongest kill case (the step is openly part of the declared gator workflow) fails because an instruction to run content the artifact does not ship is never made harmless or chain-free by the file's absence, and the follow-up confirmed review-feedback-ledger exists only outside consumed content. The skill therefore makes the agent execute unreviewable code at runtime and no carve-out or mitigation neutralizes it.

The skill's concrete run instructions for all three helpers stand while the follow-up confirmed each binary exists only outside consumed content, so the agent executes unreviewable code while performing credentialed GitHub writes; open naming of the commands is disclosure, not a carve-out.

The skill's own description of the resolver is an unverified claim by the skill body, and the follow-up confirmed the binary lies outside consumed content, so the GitHub thread-mutating writes remain unreviewable; documented-but-unverifiable behavior is not a carve-out.

The instruction to invoke a reviewer command defined by the sandbox prompt is live, and the follow-up confirmed scripts/agents/gator/prompt.md is NOT IN REPOSITORY, so at runtime the agent would invoke whatever content is at that path; absence never makes such an instruction harmless or chain-free, so the finding stands.