linear-ready
Pass
Audited by Gen Agent Trust Hub on Mar 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/linear-readyexecuteslinearandjqcommands. Input parameters are safely passed tojqusing the--argflag, preventing command injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The documentation identifies
@schpet/linear-cliandjqas prerequisites. These are external dependencies that the user is expected to install manually from well-known package registries. - [PROMPT_INJECTION]: Indirect Prompt Injection Surface: The skill retrieves issue data from the Linear platform. Since this data is external and potentially attacker-controlled, it represents a surface for indirect prompt injection if the agent follows instructions found within issue titles or descriptions.
- Ingestion points: Data is fetched from the Linear API via the
linear apicommand inscripts/linear-ready. - Boundary markers: The output does not use specific delimiters to separate issue content from system instructions.
- Capability inventory: The skill facilitates issue updates and status changes using the
linearCLI. - Sanitization: The script uses
jqto ensure valid JSON processing, but it does not perform natural language sanitization of the issue content.
Audit Metadata