qa-linear-integration
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted text from bug reports and task descriptions to populate fields in Linear issues.
- Ingestion points: Bug report and task data provided by the qa-bug-ticket-creator and qa-task-creator skills (SKILL.md).
- Boundary markers: The skill lacks explicit boundary delimiters or instructions to ignore potential commands within the interpolated description fields.
- Capability inventory: External write capabilities via GraphQL mutations (issueCreate, issueUpdate) directed to the Linear API.
- Sanitization: No sanitization or validation protocols are defined for the input text prior to its inclusion in API payloads.
- [EXTERNAL_DOWNLOADS]: The skill references and interacts with the official Linear service API.
- The skill communicates with the official Linear GraphQL endpoint at https://api.linear.app/graphql.
Audit Metadata