to-linear
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by ingesting data from untrusted external and local sources.
- Ingestion points: In Step 2, the skill fetches and reads content from user-supplied URLs, referenced issue identifiers (via Linear API), and local files such as
PLAN.md,CONTEXT.md, andAGENTS.md. - Boundary markers: The instructions lack explicit directives for the agent to use delimiters (e.g., XML tags or triple quotes) or 'ignore' instructions when processing external content.
- Capability inventory: The skill possesses write capabilities to the Linear platform using the Linear MCP server to create or modify milestones, issues, labels, and dependencies.
- Sanitization: There is no evidence of sanitization or filtering of content retrieved from external sources before it is interpolated into new Linear ticket descriptions or titles.
- Mitigation: The risk is significantly mitigated by a mandatory human review step (Step 4) where the user must explicitly approve all drafted content and dependencies before any mutations are published.
Audit Metadata