The Agent Skills Directory

[PERSISTENCE]: The skill provides instructions and commands to append environment variable exports (specifically LINEAR_API_KEY) to shell configuration files including ~/.zshrc, ~/.bashrc, and ~/.config/fish/config.fish. This allows sensitive credentials to persist across system sessions.
[CREDENTIALS_UNSAFE]: The skill facilitates the storage of sensitive Linear API keys in plain text within global shell profile files.
[DYNAMIC_EXECUTION]: The skill's core workflow involves writing JavaScript code to a temporary file (task.mjs) in a cache directory and executing it using the Node.js runtime based on task requirements.
[COMMAND_EXECUTION]: The execution pattern involves sourcing multiple shell profiles (~/.zshenv, ~/.zshrc, ~/.zprofile, ~/.profile, ~/.bashrc, ~/.bash_profile) using the source command. This executes the contents of these files within the agent's environment, which can trigger unintended side effects or execute arbitrary commands if those files contain complex scripts.
[EXTERNAL_DOWNLOADS]: The skill downloads the official @linear/sdk package from the NPM registry. As Linear is a well-known service, this reference is documented neutrally as standard dependency acquisition.
[INDIRECT_PROMPT_INJECTION]: The skill acts as an ingestion point for untrusted data from the Linear API (e.g., issue titles, descriptions, and comments).
Ingestion points: Data is fetched via SDK methods like linear.issues(), linear.issue(), and linear.searchIssues() as described in SKILL.md and references/recipes.md.
Boundary markers: None. The skill does not implement delimiters or safety instructions when processing or displaying data retrieved from Linear.
Capability inventory: The skill has the capability to write files, execute Node.js scripts, perform network operations via the Linear SDK, and modify system shell configuration files.
Sanitization: There is no evidence of sanitization, escaping, or validation of the content retrieved from Linear before it is logged to the console or used in subsequent logic.

linear-sdk-scripting