The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements endpoints to ingest external data from Linear webhooks, creating a potential attack surface for indirect prompt injection if malicious instructions are embedded in Linear events (e.g., issue titles or comments).
Ingestion points: Webhook handlers are defined in examples/fastapi/main.py, examples/express/src/index.js, and examples/nextjs/app/webhooks/linear/route.ts which accept POST requests from the external Linear service.
Boundary markers: The skill provides robust authenticity checks by verifying the Linear-Signature HMAC-SHA256 header and the webhookTimestamp field, ensuring that only authenticated and non-stale data is processed.
Capability inventory: The example code is limited to logging and event routing; it does not perform high-risk operations like shell command execution or writing to sensitive file system locations.
Sanitization: The instructions specifically warn against parsing the JSON body before verification, ensuring that signature validation is performed against the exact raw bytes received from the provider.

linear-webhooks