The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The install.sh script installs the official @linear/sdk package from the public NPM registry. This is a legitimate and expected dependency for a skill providing Linear integration.
[COMMAND_EXECUTION]: The skill implements its logic in a TypeScript CLI tool (linear.ts) which the agent is instructed to execute using npx tsx. This allows the agent to perform task management operations safely and locally.
[CREDENTIALS_UNSAFE]: The skill follows security best practices for secret management by relying on the LINEAR_API_KEY environment variable, avoiding hardcoded credentials and instructing the user on safe configuration.
[PROMPT_INJECTION]: The skill retrieves issue content (titles, descriptions, and comments) from the Linear API, creating an attack surface for indirect prompt injection.
Ingestion points: Data is fetched in scripts/linear.ts through issue retrieval and search functions.
Boundary markers: The instructions do not specify delimiters to isolate untrusted content from the rest of the agent's context.
Capability inventory: The skill is configured to use the Bash, Read, and Write tools.
Sanitization: Retreived content is passed directly to the agent without additional escaping or filtering, which is typical for this type of integration.

linear