The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill resolves a LINEAR_API_KEY for authentication by checking environment variables, using Doppler secret management tools, or executing a custom command defined in the plugin's preferences.json. This is consistent with standard secret management practices for developer tools.
[EXTERNAL_DOWNLOADS]: Makes network requests to the official Linear GraphQL API (https://api.linear.app/graphql) to synchronize issue data.
[COMMAND_EXECUTION]: The skill uses shell commands like doppler secrets get or a custom command from the configuration file to retrieve the necessary API keys at runtime.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill reads STATE.md files from the project workspace to identify active phases and completion status.
Boundary markers: No explicit delimiters or instructions are provided to the agent to distinguish between the file content and its own instructions.
Capability inventory: The skill has the ability to perform network requests (WebFetch), local task updates (TaskUpdate), and Linear API modifications (mcp__linear__*).
Sanitization: The content read from STATE.md is not validated or sanitized before being used to influence Linear API operations.

ops-linear