Linear Issues

• Analyzed: May 12, 2026, 3:06 AM
• Findings: 1
• Version: 1.0.0
• Hash: c3f4b75f5c4ffda0e9e3013d3f853242f679ac7e40cf7922b9dacfcbdcec1784
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill's core script, `scripts/linear.sh`, constructs GraphQL queries by directly embedding user-provided arguments (such as issue titles, descriptions, search terms, and comment bodies) into the JSON query string without proper sanitization. This creates a GraphQL injection vulnerability, which could allow a malicious actor to alter the intended API call, potentially leading to unauthorized data access or manipulation within the Linear API. While the skill's stated purpose is benign, this implementation flaw represents a significant security risk.