Opus finding
Trusted-author list inconsistency: SKILL.md hardcodes 'aeonframework' and 'aaronjmars' but watched-repos.md is supposed to be the source of truth
lowdocs-gapmedium
- skills/pr-triage/SKILL.md:13-17
The skill states (in Constraints) 'Trusted-author allowlist is the single source of truth for internal PRs', yet two logins are hardcoded outside the file. A forked fleet running this skill under a different owner will silently treat 'aaronjmars' and 'aeonframework' as trusted, opening a class of accidental trust for any PR opened by those GitHub users in unrelated forks.
Recommendation
Remove the hardcoded names and require Trusted Authors to live only in memory/watched-repos.md, or scope the hardcoded names to the owning org only.