Linear CLI

PassAudited by ClawScan on May 10, 2026.

Overview

This is a coherent Linear CLI helper, but it can use Linear credentials to make real workspace changes, including deletes, so users should confirm sensitive actions and trust the installed CLI.

This skill appears coherent and purpose-aligned for managing Linear from the command line. Before installing, make sure you trust the upstream linear CLI, authenticate only with the intended Linear workspace, and explicitly approve destructive, bulk, force, or raw API operations.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

If invoked on the wrong issue, project, document, or team, the agent could make unwanted changes in Linear.

Why it was flagged

The skill documents broad Linear API access and destructive issue deletion with a confirmation-skipping flag. This is aligned with managing Linear, but it can change or delete workspace data.

Skill content

linear api                # Make a raw GraphQL API request
...
# Delete an issue
linear issue delete ABC-123 -y

Recommendation

Require explicit user confirmation before updates, deletes, bulk actions, force flags, or raw GraphQL mutations; prefer scoped CLI commands over raw API calls.

Note

ASI03: Identity and Privilege Abuse

What this means

The CLI can act as the authenticated Linear user and may access or modify workspace data that account can reach.

Why it was flagged

The skill requires Linear API authentication. That credential use is expected for the integration, but it grants access according to the user's Linear permissions.

Skill content

1. Create an API key at https://linear.app/settings/account/security
2. Authenticate: `linear auth login`

Recommendation

Use only trusted Linear credentials, avoid sharing printed tokens, and revoke the API key if it may have been exposed.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the upstream CLI runs and trusts code outside the reviewed skill artifacts.

Why it was flagged

The skill is instruction-only and relies on an external CLI package; the Deno installation example grants broad permissions with `-A`.

Skill content

- **Homebrew**: `brew install schpet/tap/linear`
- **Deno**: `deno install -A --reload -f -g -n linear jsr:@schpet/linear-cli`
- **Binaries**: https://github.com/schpet/linear-cli/releases/latest

Recommendation

Install from a trusted source, prefer pinned or verified releases where possible, and review the upstream CLI before using it with Linear credentials.