Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cyrusagents/cyrus --skill cyrus-setup-lineargit clone --depth 1 https://github.com/cyrusagents/cyrusWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cyrusagents/cyrus/cyrus-setup-linear)<a href="https://agentmods.dev/skills/cyrusagents/cyrus/cyrus-setup-linear"><img src="https://agentmods.dev/badge/skills/cyrusagents/cyrus/cyrus-setup-linear/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cyrusagents/cyrus/cyrus-setup-linear"><img src="https://agentmods.dev/badge/skills/cyrusagents/cyrus/cyrus-setup-linear.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
- NVIDIA SkillSpector warn
SkillSpector: 13 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 15 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 36 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 179 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 180 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 181 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 188 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 190 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 210 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 211 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 212 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Rogue Agent · line 3 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Excessive Agency · line 102 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Rogue Agent · line 142 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.02205 |
| Opus 5.5 | $0.00011 | $0.00882 |
| Sonnet 5.5 | $0.00005 | $0.00441 |
| Haiku 4.5 | $0.00003 | $0.00220 |
Grade C, and why
cyrus-setup-linear scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Harvests environment variableshighData exfiltration
Enumerating or grepping the environment for keys collects credentials unrelated to what the mod says it does.
## Step 4: Collect Credentials How it starts
The opening of the file, as written. The whole thing — 243 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CRITICAL: Never use Read, Edit, or Write tools on ~/.cyrus/.env or any file inside ~/.cyrus/. Use only Bash commands (grep, printf >>, etc.) to interact with env files — secrets must never be read into the conversation context. Never scrape, extract, or read secret values from web pages — guide the user to copy them manually.
Setup Linear
Creates a Linear OAuth application and configures credentials so Cyrus can receive webhooks and respond to issues.
Step 1: Check Existing Configuration
grep -E '^LINEAR_CLIENT_ID=' ~/.cyrus/.env 2>/dev/null
If LINEAR_CLIENT_ID is already set, check if OAuth is also complete:
grep -q '"workspaces"' ~/.cyrus/config.json 2>/dev/null && echo "configured" || echo "not configured"
If both are set, inform the user:
Linear is already configured. Skipping this step. To reconfigure, remove
LINEAR_CLIENT_ID,LINEAR_CLIENT_SECRET, andLINEAR_WEBHOOK_SECRETfrom~/.cyrus/.envand re-run.
Skip to completion.
Step 2: Get CYRUS_BASE_URL
Read the base URL from the env file (set by setup-endpoint):
grep '^CYRUS_BASE_URL=' ~/.cyrus/.env | cut -d= -f2-
This is needed for the callback and webhook URLs.
Step 3: Create Linear OAuth App From Manifest
Linear OAuth apps must be created from a manifest-backed setup URL. Do not create the app from scratch or fill each field manually. The manifest flow keeps the app configuration reproducible and avoids drift in callback, webhook, and event type settings.
3a. Build the manifest URL
Generate a JSON OAuth app manifest and encode it into Linear's manifest query parameter:
CYRUS_BASE_URL="<CYRUS_BASE_URL>" \
AGENT_NAME="<AGENT_NAME>" \
AGENT_DESCRIPTION="<AGENT_DESCRIPTION>" \
node <<'NODE'
const fs = require("node:fs");
const baseUrl = process.env.CYRUS_BASE_URL.replace(/\/+$/, "");
const agentName = process.env.AGENT_NAME || "Cyrus";
const agentDescription =
process.env.AGENT_DESCRIPTION || "AI coding agent for automated development";
const manifest = {
$schema: "https://linear.app/.well-known/oauth-app-manifest.schema.json",
schemaVersion: "1.0.0",
distribution: "private",
display: {
description: agentDescription,
},
developer: {
name: "Self-hosted",
},
oauth: {
client_name: agentName,
client_uri: "https://github.com/ceedaragents/cyrus",
redirect_uris: [`${baseUrl}/callback`],
grant_types: ["authorization_code"],
},
webhook: {
enabled: true,
url: `${baseUrl}/linear-webhook`,
resourceTypes: [
"AgentSessionEvent",
"AppUserNotification",
"PermissionChange",
"Issue",
],
},
};
const manifestJson = JSON.stringify(manifest, null, 2);
const manifestUrl = `https://linear.app/settings/api/applications/new?manifest=${encodeURIComponent(JSON.stringify(manifest))}`;
fs.writeFileSync("/tmp/cyrus-linear-oauth-app-manifest.json", `${manifestJson}\n`);
fs.writeFileSync("/tmp/cyrus-linear-oauth-app-url.txt", `${manifestUrl}\n`);
console.log(manifestJson);
console.log(`\n${manifestUrl}`);
NODE
LINEAR_MANIFEST_URL="$(cat /tmp/cyrus-linear-oauth-app-url.txt)"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 243 lines · 27 tokens per session scan C 0a07f17ec8c6
cyrus-setup-linear is a skill published in the GitHub repository cyrusagents/cyrus (868 stars, last pushed today), licensed Apache-2.0. It adds 27 tokens to every session and 2,205 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it C with 1 finding (harvests environment variables). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
linear-tickets
Create or update high-quality Linear tickets while preserving the originating report, diagnostic links, attachments, and reporter/requester attribution. Read this whenever someone asks to create, recreate, or update a Linear issue.
linearis
Manage Linear.app work from the command line with the linearis CLI (bins linearis / linear), which outputs JSON: issues/tickets, projects, cycles (sprints), milestones, initiatives (roadmap), documents, labels, teams, users, and issue discussions/comments. Use when the user mentions Linear, a ticket identifier like…
linctl
Use linctl as the Linear control surface for agent-safe issue, project, Cycle, ProjectMilestone, organization, user, team, search, release, initiative, customer, notification, attachment, comment, and metadata work. Prefer it over Linear MCP, raw GraphQL, or ad hoc API calls when linctl covers the operation; use…
linear
Linear project management — issues, cycles, and projects via GraphQL API.
phase-closeout
A Chinese-language stage closer that summarizes completed work, records decisions, updates project status, and prepares the next conversation.
ss-archive-task
Retire a finished or abandoned task by relocating its whole folder into tasks/archive/, history preserved, so scans over the active set skip it. Use for a task that is finished or has been abandoned, or when asked to "archive", "shelve", "put this task away", "lưu trữ task", "dọn task xong". Reversible via…