Linear Issues

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:29 AM UTC
• Version: 1.0.0

Overview

This is a coherent Linear integration, but it can immediately modify shared Linear data with a stored API key and has weak input and credential safeguards.

Review this before installing in a production Linear workspace. Use a least-privilege Linear token if possible, protect any credential file with restrictive permissions, and avoid letting the assistant perform create/update/comment actions without an explicit confirmation workflow. The publisher should also switch to GraphQL variables or proper JSON encoding and add validation for IDs and priority values.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/linear.sh:124

Finding

Unsafe GraphQL and JSON construction permits authenticated query injection

Content

View full analysis

&2 exit 1 fi gql "{\"query\": \"mutation { issueUpdate(id: \\\"$issue_id\\\", input: { $input }) { success issue { id identifier title state { name } } }\"}" | fmt_update ``` ```bash cmd_comment() { local issue_id="$1" local body="$2" gql "{\"query\": \"mutation { commentCreate(input: { issueId: \\\"$issue_id\\\", body: \\\"$body\\\" }) { success comment { id body } } }\"}" | fmt_comment } ``` ### Technical Analysis Command-line values such ...[truncated 1874 chars]

Remediation

View remediation

&2 exit 1 } ``` - Validate IDs against the formats accepted by Linear before submission. - Add tests covering quotes, backslashes, newlines, Unicode, GraphQL punctuation, and malicious payload strings. - Reject unknown options instead of silently discarding them. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/linear.sh:10

Finding

Plaintext Linear credential storage lacks permission safeguards

Content

View full analysis

/dev/null || true fi } ``` ### Technical Analysis Reading a Linear credential is necessary for the Skill's declared functionality, and access is restricted to one fixed path under the current user's home directory. The project does not scan unrelated credential files or send the key to unrelated services. However, the documentation directs users to place a long-lived API key in a plaintext JSON file without instructing them to apply restrictive permissions. The script reads the file without checking its ownership or mode and does not warn when it is group-readable, world-readable, or owned by another account. The behavior therefore does not exceed the functional need to obtain an API credential, but the credential's at-rest protection is insufficient on shared or improperly configured systems. ### Attack Path 1. A user follows the setup instructions and creates `~/.clawdbot/credentials/linear.json`. 2. The file or its parent directory receives permissive permissions due to the user's `umask`, manual creation method, backup process, or synchronization tool. 3. Another local account or process reads the plaintext API key. 4. The attac ...[truncated 539 chars]

Remediation

View remediation

"$HOME/.clawdbot/credentials/linear.json" chmod 600 "$HOME/.clawdbot/credentials/linear.json" ``` - Before reading the credential, verify that the file is owned by the current effective user and is not accessible by group or other users. - Refuse to use insecure files or emit a prominent warning with corrective instructions. - Recommend minimally privileged Linear credentials where Linear's token model permits this. - Document token rotation and revocation procedures. - Avoid including real tokens in examples, logs, issue reports, or version-controlled files. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/linear.sh:30

Finding

Linear API key is exposed through curl process arguments

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

Known Vulnerable Dependency: undici==7.19.1 — 16 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +13 more

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The lockfile pins undici 7.19.1, which is associated with multiple reported HTTP parsing and connection-handling issues including request/response smuggling, response queue poisoning, and CRLF injection. Because this Linear skill performs network interactions with an issue-tracking service, flaws in its HTTP client are especially relevant: a malicious server, proxy, or crafted endpoint interaction could potentially corrupt requests, poison responses, or enable header injection across reused connections.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==7.19.1 — 16 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +13 more

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The package explicitly depends on undici 7.19.1, which is flagged as having multiple known high-severity advisories including request/response smuggling, response queue poisoning, and CRLF injection. Because this skill interacts with external services over HTTP, a vulnerable HTTP client library is security-relevant and could expose requests, responses, or headers to manipulation in certain deployment scenarios.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/linear.sh (reported line 10)May include surrounding context.

sh

API_URL="https://api.linear.app/graphql"
FORMAT="${LINEAR_FORMAT:-pretty}"  # pretty or json

# Get API key from credentials file or environment
get_api_key() {
    if [[ -n "${LINEAR_API_KEY:-}" ]]; then
        echo "$LINEAR_API_KEY"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The feature list advertises creating, updating, changing status, assigning, and commenting on Linear issues but does not warn that these actions modify external project-management data. Users may treat the skill as informational and unintentionally trigger writes through the assistant, causing workflow disruption, incorrect issue state, spam comments, or unauthorized changes in a shared workspace.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README encourages broad natural-language invocations like creating bugs, moving issues, and adding comments without defining clear activation boundaries or confirmation expectations. In an AI-assistant context, this increases the chance of unintended execution of state-changing actions from ambiguous prompts, quoted text, or mixed-context conversations, which can lead to unauthorized or accidental modifications in Linear.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill exposes shell-based operational capability via scripts/linear.sh but does not declare any permissions or allowed-tools scope. That creates an unnecessary trust gap: an agent may invoke shell commands to access credentials and perform external API actions without explicit policy boundaries, increasing the chance of overbroad execution or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file provides runnable mutation examples for creating issues, updating issues, and adding comments, which can change user or team data. There is no accompanying warning or disclosure that these examples perform write operations against a live system.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/linear.sh (reported line 7)May include surrounding context.

sh

# Linear API wrapper for Clawdbot
# Usage: linear.sh <command> [options]

API_URL="https://api.linear.app/graphql"
FORMAT="${LINEAR_FORMAT:-pretty}"  # pretty or json

# Get API key from credentials file or environment

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/linear.sh (reported line 26)May include surrounding context.

sh

API_KEY=$(get_api_key)
if [[ -z "$API_KEY" ]]; then
    echo "Error: No Linear API key found." >&2
    echo "Set LINEAR_API_KEY or create ~/.clawdbot/credentials/linear.json" >&2
    exit 1
fi

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/linear.sh (reported line 33)May include surrounding context.

sh

# Execute GraphQL query
gql() {
    local query="$1"
    curl -s -X POST "$API_URL" \
        -H "Content-Type: application/json" \
        -H "Authorization: $API_KEY" \
        -d "$query"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script performs state-changing actions against Linear—issue creation, updates, and comments—immediately and without any confirmation, dry-run mode, or explicit warning. In an agent setting, this increases the risk of accidental or prompt-induced modifications to production project data, especially when user input is transformed directly into API mutations.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fflate==0.8.2 — 1 advisory(ies): CVE-2026-45820 (fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archive)

Low

• Category: Supply Chain
• Confidence: 83% confidence

Finding

The lockfile pins fflate 0.8.2, which is reported vulnerable to an infinite loop when parsing malformed ZIP64 archives. In this skill, the risk is somewhat contextual because clawdhub depends on fflate and may process packaged skill artifacts; if an attacker can supply a crafted archive, this could cause denial of service rather than direct code execution.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 21)May include surrounding context.

json

},
  "homepage": "https://github.com/mrklnc/clawdbot-skill-linear#readme",
  "dependencies": {
    "clawdhub": "^0.3.0",
    "undici": "^7.19.1"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 22)May include surrounding context.

json

"homepage": "https://github.com/mrklnc/clawdbot-skill-linear#readme",
  "dependencies": {
    "clawdhub": "^0.3.0",
    "undici": "^7.19.1"
  }
}

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest describes creating, updating, listing, and searching issues, plus viewing assigned issues, changing status, adding comments, and managing tasks. The code additionally exposes users and projects commands that retrieve workspace-wide user and project data, which are not mentioned in the manifest description and go beyond the stated issue-centric scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.