linear-release-setup
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches documentation and example configurations from the official Linear Release repository on GitHub (
github.com/linear/linear-release). This is a standard and safe operation intended to provide the agent with the most current CLI flags and installation instructions. - [REMOTE_CODE_EXECUTION]: The generated CI configurations are designed to download and execute the Linear Release CLI binary within the user's CI environment (GitHub Actions, GitLab CI, etc.). The binary is sourced from the official vendor repository, which is consistent with the skill's stated purpose.
- [COMMAND_EXECUTION]: The skill provides templates for CI/CD jobs that include shell commands such as
git clone,curl, andapt-get install. These are standard prerequisites for setting up release automation in a pipeline context. - [INDIRECT_PROMPT_INJECTION]: The skill is instructed to ingest data from an external README file to drive its configuration generation logic, creating a potential surface for indirect injection if the source were untrusted.
- Ingestion points: Official Linear Release README located at
github.com/linear/linear-release/blob/main/README.md(referenced in SKILL.md). - Boundary markers: None explicitly defined for the ingested text.
- Capability inventory: The skill generates CI configuration files containing shell commands (
git,curl,apt-get) and environment variable mappings (SKILL.md). - Sanitization: None described; however, the source is restricted to the vendor's own official documentation repo.
Audit Metadata