linear-setup

Pass

Audited by Gen Agent Trust Hub on Jul 21, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes shell commands like git log and git status to analyze repository history for backfilling Linear issues. It also uses curl to upload visual evidence to the Linear API using signed URLs, which is a standard procedure for handling attachments in the Linear ecosystem.
  • [PROMPT_INJECTION]: The skill includes defensive instructions that explicitly forbid the agent from inventing API calls or using unofficial wrappers. It establishes strict constraints on the length and structure of issue titles and descriptions, which serves as a mitigation against potential indirect prompt injection from repository content like READMEs or CHANGELOGs.
  • [EXTERNAL_DOWNLOADS]: The skill performs network operations to interact with the Linear API for project synchronization. These operations are directed at a well-known service and are consistent with the skill's stated purpose.
  • [SAFE]: The persistence mechanisms, such as writing discipline rules to local configuration files like CLAUDE.md, are intended for maintaining workflow consistency and do not involve unauthorized file access or exfiltration.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 21, 2026, 08:36 PM
Security Audit — agent-trust-hub — linear-setup