linear-cost-tuning
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [SAFE]: The skill provides instructions for optimizing Linear integration costs and explicitly prohibits hardcoding credentials, revealing secrets, or exfiltrating sensitive data. It mandates storing credentials in an approved secret manager and redacting sensitive fields in all outputs.
- [EXTERNAL_DOWNLOADS]: The skill references official Linear documentation (
linear.app) and package metadata from thenpmregistry. These are well-known, legitimate services for the skill's intended purpose. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources, introducing a potential surface for indirect prompt injection.
- Ingestion points: The skill uses
WebFetchto read documentation fromlinear.appand metadata fromnpmjs.com. - Boundary markers: The instructions do not define specific delimiters for separating untrusted data from the agent's prompt context.
- Capability inventory: The skill has access to
Read,Glob,Grep,WebFetch,Write, andEdittools across the filesystem and network. - Sanitization: The skill mitigates risk by instructing the agent to redact sensitive fields, customer content, and unredacted GraphQL variables before providing output.
- [NO_CODE]: The skill does not distribute any executable scripts or binary files, relying solely on markdown instructions and references.
Audit Metadata