ClawHub
Back to skill

Security audit

Linear Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Linear integration that can read and modify Linear workspace data when the user invokes its documented commands.

Install this only if you are comfortable giving the skill a Linear personal API key with whatever workspace permissions that key has. Use a limited or dedicated Linear token if possible, and be careful with create, update, move, post-comment, and sync-commit commands because they make live changes without a dry-run or confirmation step.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Session Persistence

Medium
Category
Rogue Agent
Content
### 1. Get your Linear API key

1. Open Linear → **Settings → API → Personal API keys**
2. Click **Create key**, give it a name, copy the value (`lin_api_...`)

### 2. Set the environment variable
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill exposes multiple state-changing operations such as creating and updating issues/projects, moving issues, posting comments, and syncing from commit messages, but the interface provides no confirmation, dry-run mode, or explicit warning before executing them. In an agent setting, this increases the risk of unintended or prompt-induced actions against a live Linear workspace, especially because the skill accepts commands directly from stdin/CLI and dispatches them immediately.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The manifest advertises creation, update, move, comment, project, and commit-sync capabilities against a live Linear workspace, but the description does not clearly warn users that invoking these commands will modify external project-management data. This increases the risk of users triggering state-changing actions without informed consent, especially because several commands can alter issues or projects at scale.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The manifest requests a personal Linear API key but does not disclose that workspace data, issue content, comments, and project metadata will be transmitted to Linear's API when the skill is used. Users may supply sensitive credentials and organizational data without adequate notice about the privacy and data-flow implications.

External Transmission

Medium
Category
Data Exfiltration
Content
const https = require('https');

const LINEAR_ENDPOINT = 'https://api.linear.app/graphql';

class LinearClient {
  /**
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The function parses commit messages and then sends GraphQL requests that can change Linear issue state, culminating in an `issueUpdate` mutation. Although the top-level docstring states the function will move issues to a done state, there is no confirmation prompt or explicit user-facing disclosure before performing this potentially workflow-affecting remote update.

Missing User Warnings

Low
Confidence
80% confidence
Finding
The README states that `sync-commit` will "auto-close referenced issues," which can change issue state based on parsed commit messages. While the capability is documented, there is no explicit warning that this may modify multiple issues automatically or unintentionally if commit text is misparsed.

Static analysis

No suspicious patterns detected.