resolve-linear-tech-debt
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill uses official Linear MCP tools (
mcp__linear-server) to read and update issues. These interactions are consistent with the skill's documented purpose and target a well-known service. - [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes external issue data from Linear.
- Ingestion points: Issue titles and descriptions are fetched using the
mcp__linear-server__list_issuestool inSKILL.md. - Boundary markers: The fetched data is interpolated into a sub-agent prompt for the 'Explore' agent (e.g.,
Research tech debt item: "[debt title]"). While the title is wrapped in quotes, there are no specific instructions to ignore embedded commands. - Capability inventory: The skill can execute codebase exploration, update issue states, and post comments to Linear.
- Sanitization: There is no evidence of string sanitization or validation of the fetched Linear data before it is passed to the sub-agent.
Audit Metadata