linear-setup
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external and potentially untrusted data which could contain malicious instructions.
- Ingestion points: As defined in
METHODOLOGY.md(§1a, §4, and §22), the skill ingests content from Linear issues, comments, documents, and repository history (e.g., git logs and CHANGELOGs). - Boundary markers: The methodology includes a dedicated 'Trust boundary' section (§0) that explicitly instructs the agent to treat project content as data, not instructions, and to verify changes against confirmed scope. This is a robust instructional safeguard, although it does not provide technical delimiters for prompt interpolation.
- Capability inventory: The skill's primary setup function involves writing 'tracking protocols' to persistent agent instruction files like
CLAUDE.md,AGENTS.md, or.cursor/rules/(SKILL.md§7). This creates a path where untrusted external data could influence the agent's long-term behavior if the agent improperly incorporates it into these files. - Sanitization: No technical sanitization or validation of the ingested external content is specified; the skill relies on the agent's adherence to the 'Trust boundary' guidelines.
- [COMMAND_EXECUTION]:
METHODOLOGY.md(§10) outlines a procedure for uploading visual evidence using shell commands (e.g.,curl) to interact with Linear's cloud storage. This is a legitimate use of command execution to support the skill's stated purpose of providing verifiable project history.
Audit Metadata