linear-bootstrap — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited linear-bootstrap (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create a fully structured Linear project — milestones, epics, issues, labels, and dependency chains — from a plain-English description.
Before starting, confirm the linear-bootstrap MCP tools are available by checking that mcp__linear-bootstrap__list-teams is callable. Attempt to list teams.
If the tool is not found or the call fails:
The linear-bootstrap MCP server is not running. To fix this:
>
1. Check/pluginfor MCP server errors 2. Verify the server is configured in.mcp.jsonwith validLINEAR_API_KEY,LLM_API_KEY,LLM_BASE_URL, andLLM_MODEL3. Try restarting Claude Code 4. Test manually:npx @toolwright-adk/linear-bootstrap(orbunxif npx is broken)
Stop here if the server is unavailable — do not attempt to proceed without it.
Use the team list from the prerequisite check. If there is only one team, use it. If there are multiple, ask the user which team to target.
The server automatically reads your team's existing labels, workflow states, and active projects before generating a plan. No extra step needed.
Use the description from $ARGUMENTS if provided. Otherwise, ask the user what project they want to create.
Determine the project type from the description:
Determine the complexity:
Generate a project plan using the description, team, project type, and complexity. You will receive a plan reference and a summary with counts of milestones, epics, issues, and estimated points.
Show the user the summary. Ask: _"Does this look right, or should I adjust the scope?"_
If generation fails: Report the error to the user. Common causes:
LLM_API_KEYLLM_BASE_URLValidate the plan for structural issues (circular dependencies, orphaned references, etc.). If there are errors, report them and stop. If there are only warnings, show them and ask whether to proceed.
Create the project in Linear using the plan reference and team. Report what was created:
If creation partially fails: The server tracks what was created vs. what failed. Report both lists to the user. The successfully created items remain in Linear — do not retry the entire bootstrap. Instead, suggest using add-epic to fill in missing pieces, or fixing the issue in Linear directly.
If the project already exists: The server detects this and returns the existing project ID without making changes. Report this to the user.
If the user says "just do it," "don't ask," or otherwise indicates they want unattended creation, use generate-and-bootstrap to generate the plan and create the project in a single step without intermediate review.
User: /linear-bootstrap CLI tool for managing database migrations
Agent: Found team "Engineering" (ENG). I'll generate a feature project plan...
Plan ready: 3 milestones, 4 epics, 14 issues, ~28 points.
Does this look right, or should I adjust the scope?
User: Looks good, go ahead.
Agent: Created "Database Migration CLI" in Linear:
- 3 milestones, 4 epics, 14 issues, 8 dependencies
- Reused 5 existing labels, created 2 new onesUser: /linear-bootstrap just do it — webhook subscriptions API
Agent: Created "Webhook Subscriptions API" in Linear:
- 4 milestones (API design → GA), 5 epics, 18 issues
- 12 dependencies, 6 labels reusedUser: /linear-bootstrap shared logging library for the monorepo, infrastructure type
Agent: Found team "Platform" (PLT). Generating an infrastructure project plan...
Plan ready: 2 milestones (Core library ready → Org-wide adoption),
4 epics, 14 issues.
Proceed?~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.