Linear Native Node

ReviewAudited by ClawScan on May 10, 2026.

Overview

This appears to be a legitimate Linear helper, but it uses a Linear API key and can make approved changes to Linear issues or projects.

Install only if you are comfortable giving this script a Linear API key. Prefer a dedicated or least-privileged key, keep it session-scoped where possible, and only allow commands with --execute after you have reviewed the exact Linear change.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI03: Identity and Privilege Abuse

What this means

Anyone running the skill with a valid Linear API key lets it act with whatever Linear permissions that key has.

Why it was flagged

The script uses an environment-provided Linear API key as the authorization credential for Linear API calls. This is disclosed and purpose-aligned, but the key can grant access to workspace data and actions.

Skill content

function getEnv(key) { return (process.env[key] || "").trim(); } ... Authorization: apiKey,

Recommendation

Use a minimally scoped or dedicated Linear API key if possible, set it only in the intended session, and revoke it if you stop using the skill.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If approved, the skill can create projects or issues, add comments, and change issue status or priority in Linear.

Why it was flagged

The skill can mutate Linear workspace data, but the write commands are disclosed, specific to the stated purpose, and documented as requiring explicit approval plus --execute.

Skill content

Writes to Linear require explicit approval and `--execute`: ... `project-create` ... `create` ... `comment` ... `status` ... `priority`

Recommendation

Review every proposed write command before allowing --execute, especially for shared workspaces or high-visibility issues.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

A user relying only on registry metadata may not realize the skill needs a Linear API key until reading the skill instructions.

Why it was flagged

The registry metadata under-declares the credential requirement even though SKILL.md documents LINEAR_API_KEY setup. This is a metadata completeness issue, not evidence of hidden credential use.

Skill content

Required env vars: none; Env var declarations: none; Primary credential: none

Recommendation

Treat the SKILL.md setup instructions as authoritative, and registry maintainers should declare LINEAR_API_KEY as the required credential.