Linear CLI

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:32 PM UTC
• Version: 1.0.1

Overview

This Linear CLI skill is mostly coherent, but it documents high-impact destructive operations, broad third-party CLI installation, and unsafe token-handling examples without enough safety guidance.

Review the CLI source and install from a pinned, verified version if possible. Use a least-privileged Linear token, avoid commands that print or interpolate tokens, and require explicit confirmation before any delete, bulk delete, permanent delete, or GitHub PR creation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20
• Finding: Unpinned Third-Party CLI Installed with Unrestricted Deno Permissions## Vulnerability Details **File Location**: `SKILL.md:20-23` **Vulnerability Type**: Unpinned dependency with excessive runtime permissions **Risk Level**: Medium **Vulnerable Code**: ```bash If not installed: - **Homebrew**: `brew install schpet/tap/linear` - **Deno**: `deno install -A --reload -f -g -n linear jsr:@schpet/linear-cli` - **Binaries**: https://github.com/schpet/linear-cli/releases/latest ``` ### Technical Analysis The Skill delegates its operational behavior to an externally distributed `linear` CLI. The documented Deno installation command uses a mutable, unpinned package reference and grants unrestricted permissions through `-A`. In Deno, `-A` enables all permissions, including filesystem access, environment-variable access, network communication, subprocess execution, and other system capabilities. This exceeds the minimum permissions that can be established from the Skill's declared Linear-management functionality. The use of `--reload` also forces dependency retrieval without documenting integrity verification. The Homebrew alternative similarly relies on a third-party tap, while the binary installation alternative points users to a mutable latest-release URL. No exact version, checksum, signature verification procedure, or immutable artifact digest is supplied. No evidence establishes that the current upstream package is malicious. The vulnerability is the unsafe trust and installation model, which would allow a compromised or unexpectedly modified dependency to execute with the user's full privileges. ### Attack Path 1. An attacker compromises the upstream package, release process, package account, or third-party Homebrew tap. 2. The attacker publishes a modified CLI under the same mutable package or release reference. 3. A user follows the documented installation command. 4. Deno downloads and globally installs the modified package without a pinned version or documented integrity check. 5. ...[truncated 1079 chars]
• Remediation: ## Remediation Suggestions 1. Pin the CLI to a specific reviewed version rather than using a mutable package or latest-release reference. 2. Pin downloaded binaries by cryptographic digest and document checksum or signature verification. 3. Remove `--reload` from normal installation instructions to prevent unnecessary dependency refreshes. 4. Replace `-A` with explicitly enumerated Deno permissions limited to required hosts, files, environment variables, and subprocesses. 5. Prefer a trusted distribution channel with provenance attestations and signed releases. 6. Document the exact upstream repository and package identity so users can detect dependency confusion or package substitution. 7. Periodically audit the pinned CLI version and its transitive dependencies before updating. 8. Recommend running the CLI under a dedicated, least-privileged account or isolated environment when practical.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/api.md:84
• Finding: Linear API Token Exposed Through Process Command-Line Arguments## Vulnerability Details **File Location**: `references/api.md:84-92` **Vulnerability Type**: Sensitive credential exposed in process arguments **Risk Level**: Medium **Vulnerable Code**: ```bash ### Using curl directly For cases where you need full HTTP control: ```bash curl -s -X POST https://api.linear.app/graphql \ -H "Content-Type: application/json" \ -H "Authorization: $(linear auth token)" \ -d '{"query": "{ viewer { id name } }"}' ``` ``` ### Technical Analysis The shell evaluates `$(linear auth token)` before launching `curl`. The resulting bearer token becomes part of curl's argument vector as the value of the `Authorization` header. Depending on operating-system process visibility controls and the execution environment, command-line arguments may be observable through process inspection, tracing, diagnostics, audit systems, crash reports, or process-monitoring software. The token could therefore be disclosed to another local user or process with sufficient visibility. Sending an authentication token to `https://api.linear.app/graphql` is necessary for the documented authenticated API operation and is consistent with the Skill's declared functionality. There is no evidence that the token is transmitted to an unrelated or attacker-controlled endpoint. The vulnerability is the local handling of the token through command-line arguments, not the intended HTTPS request to Linear. The same unsafe example also appears in `SKILL.md:179-185`. ### Attack Path 1. A user executes the documented curl command. 2. The shell runs `linear auth token` and substitutes the plaintext token into the header argument. 3. Curl starts with the token present in its process argument vector. 4. A local process, user, monitoring agent, debugger, or audit facility with access to process arguments captures the header value while curl is running or from retained telemetry. 5. The attacker extracts the bearer token. 6 ...[truncated 1047 chars]
• Remediation: ## Remediation Suggestions 1. Remove the direct curl example and recommend `linear api`, which handles authentication internally without requiring users to print and interpolate the raw token. 2. Remove or strongly discourage workflows based on `linear auth token`, especially in interactive shells and automation logs. 3. If direct HTTP access must be documented, pass the sensitive header through a protected mechanism that does not expose the token in the process argument vector. 4. Store any temporary credential-bearing configuration with restrictive permissions and delete it immediately after use. 5. Ensure shell tracing, verbose logging, command echoing, and CI diagnostic capture are disabled around authentication operations. 6. Add an explicit warning that API tokens must not be placed in command lines, shell history, source files, or logs. 7. Recommend narrowly scoped API credentials where Linear supports them, along with regular rotation and immediate revocation after suspected disclosure. 8. Apply the same correction to the duplicate curl example at `SKILL.md:179-185`.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation includes a destructive command (`linear issue delete ABC-123 -y`) that suppresses confirmation and provides no warning about permanence or safe usage. In an agent skill context, this increases the chance that a user or automation copies the example verbatim and deletes production issues unintentionally.

External Transmission

Medium

• Category: Data Exfiltration

Content

linear api '{ issues(first: 5) { nodes { identifier title } } }' | jq '.data.issues.nodes[].title'
```

### Using curl directly

```bash
curl -s -X POST https://api.linear.app/graphql \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation demonstrates direct use of an authentication token in a raw `curl` request without cautioning about token handling, shell history, logging, or output exposure. In a skill used by agents or users, this can normalize unsafe token practices and increase the risk of credential leakage during debugging, scripting, or transcript capture.

External Transmission

Medium

• Category: Data Exfiltration

Content

linear api '{ viewer { id } }' --silent && echo "authenticated" || echo "not authenticated"
```

### Using curl directly

For cases where you need full HTTP control:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

For cases where you need full HTTP control:

```bash
curl -s -X POST https://api.linear.app/graphql \
  -H "Content-Type: application/json" \
  -H "Authorization: $(linear auth token)" \
  -d '{"query": "{ viewer { id name } }"}'

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

For cases where you need full HTTP control:

```bash
curl -s -X POST https://api.linear.app/graphql \
  -H "Content-Type: application/json" \
  -H "Authorization: $(linear auth token)" \
  -d '{"query": "{ viewer { id name } }"}'

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation explicitly instructs users to print an API token with `linear auth token` for use in curl/scripts, but provides no warning about shell history, process listing, logging, or accidental disclosure in pasted commands and CI output. While this is common operational guidance, exposing bearer tokens in plaintext increases the chance of credential leakage and unauthorized API access.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This markdown file documents document deletion, including permanent and bulk delete operations, but it does not warn users about the risk of irreversible data loss or advise confirmation before use. Under the markdown-specific warning criteria, destructive behaviors that affect user data should be accompanied by clear warnings.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest describes this skill as managing Linear issues, projects, teams, documents, and interacting with the Linear CLI/API. The `pull-request (pr)` subcommand creates GitHub pull requests via the `gh` CLI, which is a separate service and capability not covered by the stated Linear-focused scope.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Creating a GitHub pull request is not an obvious requirement of managing Linear issues from the command line, even if issue details are used to pre-fill the PR. This adds a cross-system capability against GitHub that the manifest does not declare as part of the skill's purpose.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation includes bulk and non-interactive issue deletion paths without any visible warning about irreversible consequences, increasing the chance of accidental destructive use. In an agent or automation context, bulk deletion from arguments, files, or stdin can amplify operator mistakes and lead to large-scale data loss very quickly.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| Flag | Description |
|---|---|
| `-y, --confirm` | Skip confirmation |
| `--bulk <ids...>` | Delete multiple issues |
| `--bulk-file <file>` | Read IDs from file |
| `--bulk-stdin` | Read IDs from stdin |

• Confidence: 93% confidence
• Finding: A `--confirm` flag that skips confirmation removes an important human-in-the-loop safeguard for destructive actions. In scripted, agentic, or mistaken-command scenarios, this can cause immediate irreversible issue deletion with no last-chance review, making accidental misuse significantly more likely.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This markdown file documents commands that create projects and milestones, and also references milestone deletion, which can affect user data and system state. Under the markdown criteria for missing warnings, there is no visible caution or disclosure about these write/destructive behaviors anywhere in the description.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation exposes a destructive `team delete` command and highlights forced deletion (`-y, --force`) without any adjacent warning about irreversibility, scope of deletion, or safeguards. In an agent or automation context, this increases the chance that users or downstream systems invoke team deletion non-interactively and accidentally remove teams or trigger bulk issue movement with insufficient review.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| Flag | Description |
|---|---|
| `--move-issues <targetTeam>` | Move all issues to another team before deletion |
| `-y, --force` | Skip confirmation prompt |

**Examples:**

• Confidence: 85% confidence
• Finding: The `-y, --force` flag explicitly skips the confirmation prompt for deleting a team, enabling autonomous execution of a destructive action. In skill-driven or scripted environments, removing the human confirmation step materially raises the risk of accidental or unauthorized deletion, especially when combined with agent decisions or parameter mistakes.

Static analysis

No suspicious patterns detected.