batch-linear-tickets
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is subject to indirect prompt injection because it ingests and processes data from Linear tickets, such as titles, descriptions, and comments. This data originates from untrusted external sources and is used to drive the logic of investigation, planning, and execution agents.
- Ingestion points: Untrusted ticket content is fetched via Linear MCP tools (e.g.,
mcp__claude_ai_Linear__get_issue) during the classification and investigation phases (SKILL.md, Phase 1). - Boundary markers: While the skill uses structured templates (e.g.,
templates/feature-pack.md) to organize data, it does not explicitly implement instruction-isolation delimiters or specific 'ignore embedded instructions' warnings for ticket content. - Capability inventory: The orchestrator dispatches powerful agents including
aw-executor, which has the capability to modify code and use theghCLI to create Pull Requests (SKILL.md, Phase 4). - Sanitization: There is no explicit description of sanitization or filtering applied to external ticket content before it is interpolated into agent prompts.
- [COMMAND_EXECUTION]: The workflow relies on the execution of shell commands via the
gh(GitHub) andgw(Git Worktree) CLI tools. These tools are used for worktree management and Pull Request creation as part of the implementation phase (SKILL.md, Phase 4).
Audit Metadata