ClawHub
Back to skill

Security audit

Maverick Linear MCPorter

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently connects an agent to Linear's hosted MCP server with disclosed OAuth setup, but it can read and write Linear workspace data using the connected account.

Install only if you want the agent to access your Linear workspace through the connected OAuth account. Review the OAuth grant scope, avoid sending unrelated secrets or personal data through Linear tool calls, and require explicit confirmation before creating, updating, or deleting Linear records.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description says this skill is a thin pass-through to Linear's MCP server for reading and writing Linear workspace data. The supplied code does not interact with Linear data at all. Instead, it performs setup/initialization work: it reads OAuth credentials from environment variables, constructs a token payload, and writes that payload into an mcporter vault entry for an MCP server. This is a materially different primary purpose and introduces undeclared capabilities around credential handling and local auth-state mutation. Although this may support access to an MCP server, it is not itself a Linear data access pass-through.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The activation guidance is broad enough that an agent may invoke the skill for generic requests about Linear work without first establishing whether the user wants live workspace access. That can cause unnecessary connection to an external service and increase the chance of unintended data access or mutation, especially because the skill exposes both read and write capabilities.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Instructing the agent to 'call any tool from the catalog' delegates trust to whatever the remote MCP server advertises at runtime, including newly added or unexpectedly dangerous tools. Because the server is the live source of truth and the skill is a thin pass-through, this expands the effective permission surface beyond what was statically reviewed and could enable destructive writes, deletions, or broader data access than anticipated.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

The output includes Linear's Instructions: field (read it — it specifies, for example, how to format markdown content) and a JSON Schema for every tool's parameters. Treat this as the authoritative reference for the rest of the session.

Step 2 — Call any tool from the catalog using the form <server>.<tool> where <server> is maverick-linear (the local registration key, not Linear's announced name):

sh
mcporter --config {baseDir}/mcporter.json call maverick-linear.<tool> <arg>=<value> ...