Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Linear integration that uses your Linear API key to list, create, and update Linear workspace items directly through Linear's API.
Install only if you want an agent to use your Linear API key for both reading and changing Linear issues. Use a least-privileged Linear key if possible, avoid exposing the key in logs or shared shells, and confirm create/update commands before running them in important workspaces.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
)
try:
with urllib.request.urlopen(req) as resp:
result = json.loads(resp.read())
if "errors" in result:
for err in result["errors"]:
The skill requires environment access to a live API key and performs network operations against Linear, but it does not declare an explicit tool scope such as permissions or allowed-tools. This increases the chance that an agent can invoke the skill with broader-than-expected capabilities, reducing transparency and weakening least-privilege controls around a credentialed external integration.
The usage examples include create and update operations against a live Linear workspace, but the skill description does not clearly warn that commands can modify real issues and projects. In an agent setting, missing this warning can lead to unintended state changes, accidental ticket creation, or workflow disruption because users may assume the skill is read-only.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import sys
import urllib.request
ENDPOINT = "https://api.linear.app/graphql"
PRIORITY_LABELS = {0: "None", 1: "Urgent", 2: "High", 3: "Normal", 4: "Low"}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import sys
import urllib.request
ENDPOINT = "https://api.linear.app/graphql"
PRIORITY_LABELS = {0: "None", 1: "Urgent", 2: "High", 3: "Normal", 4: "Low"}
The skill instructs users to set a Linear API key in an environment variable but does not include guidance on secure handling of that credential. Without warnings, users may paste the key into logs, shell history, shared terminals, or screenshots, increasing the risk of credential exposure and unauthorized workspace access.
No suspicious patterns detected.