The Agent Skills Directory

[DATA_EXFILTRATION]: The skill logic extracts file paths from untrusted Linear comments and proceeds to read those files from the local filesystem without path validation or restriction.
Evidence: In SKILL.md under section 3a, the instructions state: "Extract file paths from the Changes section of completion comment → read files."
Risk: A malicious actor can post a Linear comment containing paths to sensitive files like ~/.ssh/id_rsa or .env. The agent, following the skill instructions, will read these files and may include their contents in the review report posted back to the Linear API, leading to credential theft or sensitive data exposure.
[PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection because it incorporates untrusted data from Linear issues and comments into its core decision-making logic without sanitization or boundary markers.
Ingestion points: SKILL.md (Step 3a) reads data from Linear issue descriptions (Acceptance Criteria, Done Criteria) and worker comments (Completion reports).
Boundary markers: Absent. The skill does not provide the agent with delimiters or instructions to ignore embedded commands within the content being reviewed.
Capability inventory: The skill utilizes file reading capabilities and the Linear:save_comment tool, which can be weaponized if the agent is manipulated by injected instructions.
Sanitization: Absent. There is no validation of the integrity or safety of the content retrieved from the Linear API before it is used to drive agent actions.

linear-issue-reviewer