kill-the-standup
Automates daily standup updates by fetching Linear issues and GitHub commits, formatting them, and posting to Slack.
Install this skill
Security score
The kill-the-standup skill was audited on May 22, 2026 and we found 13 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 19 | ```bash |
Template literal with variable interpolation in command context
| 78 | ```bash |
Curl to non-GitHub URL
| 43 | curl -s -X POST https://api.linear.app/graphql \ |
Curl to non-GitHub URL
| 53 | curl -s -X POST https://api.linear.app/graphql \ |
Webhook reference - potential data exfiltration
| 21 | echo "SLACK_WEBHOOK_URL: ${SLACK_WEBHOOK_URL:+set}" |
Webhook reference - potential data exfiltration
| 29 | **If SLACK_WEBHOOK_URL is missing:** |
Webhook reference - potential data exfiltration
| 30 | Stop. Tell the user: "SLACK_WEBHOOK_URL is required. Create an Incoming Webhook at api.slack.com/apps → Your App → Incoming Webhooks. Add it to your .env file." |
Webhook reference - potential data exfiltration
| 131 | curl -s -X POST "$SLACK_WEBHOOK_URL" \ |
Webhook reference - potential data exfiltration
| 162 | curl -s -X POST "$SLACK_WEBHOOK_URL" -H "Content-Type: application/json" -d @/tmp/standup-payload.json |
Access to .env file
| 27 | Stop. Tell the user: "LINEAR_API_KEY is required. Get it from Linear → Settings → API → Personal API keys. Add it to your .env file." |
Access to .env file
| 30 | Stop. Tell the user: "SLACK_WEBHOOK_URL is required. Create an Incoming Webhook at api.slack.com/apps → Your App → Incoming Webhooks. Add it to your .env file." |
External URL reference
| 43 | curl -s -X POST https://api.linear.app/graphql \ |
External URL reference
| 53 | curl -s -X POST https://api.linear.app/graphql \ |