linear-cost-tuning

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
  • [SAFE]: The skill provides instructions for optimizing Linear integration costs and explicitly prohibits hardcoding credentials, revealing secrets, or exfiltrating sensitive data. It mandates storing credentials in an approved secret manager and redacting sensitive fields in all outputs.
  • [EXTERNAL_DOWNLOADS]: The skill references official Linear documentation (linear.app) and package metadata from the npm registry. These are well-known, legitimate services for the skill's intended purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources, introducing a potential surface for indirect prompt injection.
  • Ingestion points: The skill uses WebFetch to read documentation from linear.app and metadata from npmjs.com.
  • Boundary markers: The instructions do not define specific delimiters for separating untrusted data from the agent's prompt context.
  • Capability inventory: The skill has access to Read, Glob, Grep, WebFetch, Write, and Edit tools across the filesystem and network.
  • Sanitization: The skill mitigates risk by instructing the agent to redact sensitive fields, customer content, and unredacted GraphQL variables before providing output.
  • [NO_CODE]: The skill does not distribute any executable scripts or binary files, relying solely on markdown instructions and references.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 08:05 PM
Security Audit — agent-trust-hub — linear-cost-tuning