The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes subprocess.run and subprocess.Popen to call local utilities such as herdr, gh, and git. These interactions are performed using structured argument lists, which effectively prevents shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The wait-linear utility performs network requests to the official Linear GraphQL API (api.linear.app). These interactions are used solely to fetch issue metadata and comments as specified in the skill's documentation.
[INDIRECT_PROMPT_INJECTION]: Several scripts ingest data from external platforms, including GitHub PR threads and Linear issue comments. This data is incorporated into the agent's context to inform its actions. While this introduces a surface for indirect injection, the skill acts as a data retriever rather than an execution engine for the content.
[CREDENTIALS_UNSAFE]: The skill manages authentication for the Linear API via the LINEAR_API_KEY environment variable. This follows standard security practices for CLI tools and avoids the risk associated with hardcoded secrets.

agent-scripts