Vellum Assistant is a personal AI assistant that remembers information about users, learns their preferences, and takes actions across connected apps. It is intended for people who want an assistant that can manage conversations, unfinished work, and proactive notifications over time. The catalogue skills, hooks, instruction, and setting configure or extend how the assistant works.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vellum-ai/vellum-assistant --skill linear-app-setupgit clone --depth 1 https://github.com/vellum-ai/vellum-assistantWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vellum-ai/vellum-assistant/linear-app-setup)<a href="https://agentmods.dev/skills/vellum-ai/vellum-assistant/linear-app-setup"><img src="https://agentmods.dev/badge/skills/vellum-ai/vellum-assistant/linear-app-setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vellum-ai/vellum-assistant/linear-app-setup"><img src="https://agentmods.dev/badge/skills/vellum-ai/vellum-assistant/linear-app-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Data Exfiltration · line 70 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 70 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.01086 |
| Opus 5 | $0.00014 | $0.00543 |
| Sonnet 5 | $0.00005 | $0.00217 |
| Haiku 4.5 | $0.00003 | $0.00109 |
Grade A, and why
linear-app-setup scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s -X POST https://api.linear.app/graphql \ How it starts
The opening of the file, as written. The whole thing — 148 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Overview
Set up a Linear agent app so the assistant operates under its own identity in a Linear workspace — creating issues, commenting, updating status, etc. as itself.
Linear agent apps act as their own entity in the workspace. They're free (don't count as billable users), can be @mentioned, and can be delegated issues.
Total manual effort: ~3 interactions — create the app, grab the API key, (optionally) upload an avatar.
Prerequisites
- User must be a workspace admin in Linear
- User must be logged into Linear in their browser
Setup Flow
Step 1: Create the Application
Direct the user to create a new application:
Open https://linear.app/settings/api/applications/new to create a new application.
Guide them through the form:
| Field | Value |
|---|---|
| Application name | The assistant's name. This is how the agent appears in mentions and filters. |
| Developer name | The user's name or org name |
| Developer URL | Any valid URL |
Click Create when done.
Step 2: Generate an API Key for the App
After creating the app, the user should generate a personal API key scoped to this app identity. This is how the assistant authenticates — simpler and more reliable than the full OAuth token refresh flow.
Direct the user:
On the app's settings page, look for the option to create an API key for this application. Copy the key.
Prompt for the API key via secure UI:
assistant credentials prompt --service linear --field api_key \
--label "Linear App API Key" \
--placeholder "lin_api_xxxxxxxxxx" \
--description "API key for your Linear app (used to authenticate API requests)" \
--allowed-domains "api.linear.app" \
--allowed-tools "bash" \
--injection-templates '[{"hostPattern":"api.linear.app","injectionType":"header","headerName":"Authorization","valuePrefix":"Bearer "}]'
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 148 lines · 27 tokens per session scan A 2725bd2ed5b0
linear-app-setup is a skill published in the GitHub repository vellum-ai/vellum-assistant (1,204 stars, last pushed today), licensed MIT. It adds 27 tokens to every session and 1,086 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
status-report
Use when the user asks for a weekly / monthly status report, project update, individual or team progress summary. Produces a tight, scannable update with what shipped, what's in flight, what's blocked, and metrics.
task-workstream-grouping
Infer stable semantic workstreams for ungrouped Sutando task history and apply the validated assignments to the durable workstream sidecar. Use for internal task-workstream-grouping maintenance tasks, initial history backfills, and later batches of tasks that need cross-channel or cross-device workstream organization.
sutando-migrate
M1 Part 2 workspace migration — guided walkthrough that scans legacy state across sources A (repo-root), B (/.sutando/workspace/), C ($SUTANDOWORKSPACE env-override), surfaces collisions, gets owner greenlight, commits, verifies, and (if sutando-plus + sync configured) re-routes the vault .git via…
issue-triage
3-phase issue backlog management with audit, deep analysis, and validated triage actions. Use when triaging GitHub issues, sorting bug reports, cleaning up stale tickets, or detecting duplicate issues. Args: 'all' to analyze all, issue numbers to focus (e.g. '42 57'), 'en'/'fr' for language, no arg = audit only.
plan-pipeline
Orchestrates the complete planning pipeline: product direction (ceo-review) -> architecture (eng-review) -> implementation plan (start) -> validation (validate) -> execution (execute). Run stages individually or let the orchestrator coordinate the full flow.
routines-discover
Analyzes the current project to surface high-value Routines use cases across the three trigger types (schedule, API, GitHub events). Usage: /routines-discover.