The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes content from external Linear issue descriptions which may be controlled by malicious actors.
Ingestion points: Data enters the agent context via the get_issue tool (issue description) and by following file paths extracted from 'GitHub permalinks' within those descriptions (SKILL.md, Step 2 and Step 3).
Boundary markers: Absent. The skill does not instruct the agent to use delimiters or to ignore potential instructions embedded within the issue description or the code references it follows.
Capability inventory: The skill allows reading local files, writing to the .gitignore file, creating new markdown files in the .plans/ directory, and creating new sub-issues on the Linear platform via the save_issue tool.
Sanitization: Absent. There is no specified validation to ensure that file paths extracted from 'GitHub permalinks' in the issue description are restricted to the workspace or exclude sensitive system/configuration files.
[DATA_EXFILTRATION]: The skill exhibits an information exposure risk by allowing the local filesystem to be queried based on external input. An attacker could potentially craft a Linear issue containing references to sensitive local files (e.g., .env, .ssh/config), which the agent would then attempt to read and summarize into the implementation plan.

plan-linear-issue