The Agent Skills Directory

[SAFE]: The skill is implemented using Node.js built-ins only, intentionally avoiding external npm dependencies to maintain a small, auditable footprint.
[COMMAND_EXECUTION]: Command execution is limited to standard, well-known development tools including git, pnpm, and node. The scripts use spawnSync with argument arrays, which effectively prevents shell injection vulnerabilities.
[DATA_EXPOSURE]: Access to files is restricted to local repository configuration files (such as package.json, .nvmrc, and pnpm-workspace.yaml) for the purpose of environment detection and workspace mapping. No sensitive files or credentials are accessed.
[OBFUSCATION]: Analysis of the source code and documentation found no evidence of Base64 encoding, homoglyphs, zero-width characters, or other obfuscation techniques.
[PROMPT_INJECTION]: The instructions provided to the agent are focused on operational logic, error handling, and the 'fix/defer' loop. There are no attempts to bypass safety filters or override the agent's core constraints.
[DYNAMIC_CONTEXT_INJECTION]: The skill does not utilize the dynamic context execution pattern (!command) in its markdown files.
[REMOTE_CODE_EXECUTION]: The skill does not download or execute code from remote sources. It invokes the Linear MCP server for issue tracking, which is a legitimate and declared capability.

preflight