add-linear
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches Linear adapter files from a dedicated repository branch (channels) and installs the Node.js package @chat-adapter/linear@4.29.0.
- [COMMAND_EXECUTION]: Executes shell commands to build the project, run tests, and configure messaging groups using the ncl CLI tool.
- [PROMPT_INJECTION]: Identified a potential command injection surface where unvalidated user inputs are interpolated directly into shell commands.
- Ingestion points: User prompts in SKILL.md for linear_team_key and agent_folder.
- Boundary markers: Absent; inputs are directly placed in command strings without delimiters.
- Capability inventory: Shell execution via nc:run in SKILL.md.
- Sanitization: Absent; no validation or escaping is applied to these inputs before execution.
Audit Metadata