linear-batch-implement
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes issue descriptions and comments fetched from the Linear project management platform. This is a common pattern for integration agents.
- Ingestion points: Data enters the context via the
linearMCP server toolslist_issues,get_issue, andlist_comments, which read potentially untrusted content from Linear issue headers and comments. - Boundary markers: The agent relies on specific Markdown/HTML comment blocks (
<!-- linear-ai:plan v1 -->,<!-- linear-ai:status v1 -->) to delimit structured data from unstructured prose. - Capability inventory: The orchestrator has the authority to dispatch subagents (
$linear-ai:linear-implement) which possess workspace write access, Git tool access, and the ability to execute package manager commands. - Sanitization: The skill includes a robust validation mechanism using
scripts/validate_marked_comments.ts. This script uses the AJV library to strictly validate the YAML payload against formal JSON schemas (schemas/*.schema.yaml), checking for required fields, value types, and allowed enums before the agent acts on the data. - [COMMAND_EXECUTION]: The skill executes a local TypeScript utility (
scripts/validate_marked_comments.ts) to perform integrity checks on Linear comments. This script is used defensively to ensure that only well-formed data following the established protocol is processed by the agent. Furthermore, the skill enforces strict execution isolation by requiring each implementation task to run in its own isolated Git worktree (.worktrees/<issue-id>), preventing cross-issue side effects.
Audit Metadata