Vellum Assistant is a personal AI assistant that remembers information about users, learns their preferences, and takes actions across connected apps. It is intended for people who want an assistant that can manage conversations, unfinished work, and proactive notifications over time. The catalogue skills, hooks, instruction, and setting configure or extend how the assistant works.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vellum-ai/vellum-assistant --skill linear-app-setupgit clone --depth 1 https://github.com/vellum-ai/vellum-assistantWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vellum-ai/vellum-assistant/linear-app-setup)<a href="https://agentmods.dev/skills/vellum-ai/vellum-assistant/linear-app-setup"><img src="https://agentmods.dev/badge/skills/vellum-ai/vellum-assistant/linear-app-setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vellum-ai/vellum-assistant/linear-app-setup"><img src="https://agentmods.dev/badge/skills/vellum-ai/vellum-assistant/linear-app-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Data Exfiltration · line 70 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 70 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.01086 |
| Opus 5.5 | $0.00011 | $0.00434 |
| Sonnet 5.5 | $0.00005 | $0.00217 |
| Haiku 4.5 | $0.00003 | $0.00109 |
Grade A, and why
linear-app-setup scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s -X POST https://api.linear.app/graphql \ How it starts
The opening of the file, as written. The whole thing — 148 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Overview
Set up a Linear agent app so the assistant operates under its own identity in a Linear workspace — creating issues, commenting, updating status, etc. as itself.
Linear agent apps act as their own entity in the workspace. They're free (don't count as billable users), can be @mentioned, and can be delegated issues.
Total manual effort: ~3 interactions — create the app, grab the API key, (optionally) upload an avatar.
Prerequisites
- User must be a workspace admin in Linear
- User must be logged into Linear in their browser
Setup Flow
Step 1: Create the Application
Direct the user to create a new application:
Open https://linear.app/settings/api/applications/new to create a new application.
Guide them through the form:
| Field | Value |
|---|---|
| Application name | The assistant's name. This is how the agent appears in mentions and filters. |
| Developer name | The user's name or org name |
| Developer URL | Any valid URL |
Click Create when done.
Step 2: Generate an API Key for the App
After creating the app, the user should generate a personal API key scoped to this app identity. This is how the assistant authenticates — simpler and more reliable than the full OAuth token refresh flow.
Direct the user:
On the app's settings page, look for the option to create an API key for this application. Copy the key.
Prompt for the API key via secure UI:
assistant credentials prompt --service linear --field api_key \
--label "Linear App API Key" \
--placeholder "lin_api_xxxxxxxxxx" \
--description "API key for your Linear app (used to authenticate API requests)" \
--allowed-domains "api.linear.app" \
--allowed-tools "bash" \
--injection-templates '[{"hostPattern":"api.linear.app","injectionType":"header","headerName":"Authorization","valuePrefix":"Bearer "}]'
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 148 lines · 27 tokens per session scan A 2725bd2ed5b0
linear-app-setup is a skill published in the GitHub repository vellum-ai/vellum-assistant (1,454 stars, last pushed yesterday), licensed MIT. It adds 27 tokens to every session and 1,086 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
linear-tickets
Create or update high-quality Linear tickets while preserving the originating report, diagnostic links, attachments, and reporter/requester attribution. Read this whenever someone asks to create, recreate, or update a Linear issue.
status-report
Use when the user asks for a weekly / monthly status report, project update, individual or team progress summary. Produces a tight, scannable update with what shipped, what's in flight, what's blocked, and metrics.
dex-backlog
Show the AI-ranked backlog of Dex system-improvement ideas. Use when the user says 'show my Dex ideas', 'what's in the backlog', 'what should we build next'. Not for workshopping one idea into a plan; use dex-improve. Not for discovering existing features; use dex-level-up.
product-brief
Extract a product idea through guided questions and generate a PRD. Use when the user says 'write a PRD', 'spec this feature', 'turn this idea into a brief'. Not for a non-product initiative like hiring or partnerships (use initiative-kickoff once shipped); not for checking existing projects' status (use…
triage
Route orphaned inbox files and pull scattered - [ ] tasks into the right project/person/goal using current priorities. Use when the user says 'clean up my inbox', 'triage', 'sort out these notes'. Also use proactively when 00-Inbox/ is piling up. Not for updating notes from meetings; use process-meetings.
feature-decision
Framework for making feature prioritization decisions.