Linearis
v1.0.0Linear.app CLI for issue tracking. Use for listing, creating, updating, and searching Linear issues, comments, documents, cycles, and projects. Optimized for LLM agents with JSON output.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the actual behavior: the skill expects the 'linearis' CLI and documents commands for listing/creating/updating Linear issues, comments, documents, cycles, and projects. Requiring the 'linearis' binary (provided by the npm package) is appropriate for the stated purpose.
Instruction Scope
SKILL.md stays within scope (CLI usage examples and JSON output handling). It documents authentication methods and recommends storing a Linear personal API key in ~/.linear_api_token or using LINEAR_API_TOKEN/--api-token; that is expected for a CLI that talks to Linear, but the manifest did not declare this env requirement. The instructions also include upload/download commands which legitimately allow transferring files to/from Linear.
Install Mechanism
Install is an npm package ('linearis'), which is a reasonable, expected distribution channel for a Node-based CLI. This is moderate-risk in general (npm packages should be reviewed), but it is proportionate and expected for this skill.
Credentials
The skill manifest lists no required environment variables, yet SKILL.md documents three auth methods (file at ~/.linear_api_token, LINEAR_API_TOKEN env var, or --api-token). Requesting a Linear personal API key is appropriate, but the registry metadata should declare this (e.g., requires.env: LINEAR_API_TOKEN or primary credential).
Persistence & Privilege
The skill does not request always: true, does not declare system-level config paths beyond the optional ~/.linear_api_token, and is user-invocable. It does not ask to modify other skills or agent-wide settings.
Assessment
This skill is coherent with its stated purpose: it wraps the 'linearis' CLI and requires a Linear personal API key. Before installing: (1) Be prepared to provide a Linear API key — SKILL.md suggests storing it in ~/.linear_api_token, exporting LINEAR_API_TOKEN, or passing --api-token; prefer the method that fits your security posture and set tight file permissions if you write the token file. (2) The registry metadata did not declare the LINEAR_API_TOKEN requirement — treat that as a minor metadata omission and verify you supply the token securely. (3) The install uses npm; review the 'linearis' package source (linked docs/ GitHub) or install in a sandbox/container if you want to limit risk from third-party npm packages. (4) Expect that any data sent/received by the CLI goes to Linear.app (normal for this tool).Like a lobster shell, security has layers — review code before you run it.
Runtime requirements
📋 Clawdis
Binslinearis
Install
Install linearis (npm)
Bins: linearis
npm i -g linearislatest
linearis
CLI for Linear.app with JSON output, designed for LLM agents.
Setup
npm install -g linearis
Auth (one of):
echo "lin_api_..." > ~/.linear_api_token(recommended)export LINEAR_API_TOKEN="lin_api_..."--api-token <token>flag
Get API key: Linear Settings → Security & Access → Personal API keys
Commands
Issues
linearis issues list -l 20 # List recent issues
linearis issues list -l 10 --team WHO # Filter by team
linearis issues search "bug" # Full-text search
linearis issues read ABC-123 # Get issue details
linearis issues create --title "Fix bug" --team WHO --priority 2
linearis issues update ABC-123 --status "Done"
linearis issues update ABC-123 --title "New title" --assignee user123
linearis issues update ABC-123 --labels "Bug,Critical" --label-by adding
linearis issues update ABC-123 --parent-ticket EPIC-100 # Set parent
Comments
linearis comments create ABC-123 --body "Fixed in PR #456"
Documents
linearis documents list
linearis documents list --project "Backend"
linearis documents create --title "Spec" --content "# Overview..."
linearis documents read <doc-id>
linearis documents update <doc-id> --content "Updated"
linearis documents delete <doc-id>
File Uploads/Downloads
linearis embeds upload ./screenshot.png
linearis embeds download "<url>" --output ./file.png
Teams, Users, Projects
linearis teams list
linearis users list --active
linearis projects list
linearis cycles list --team WHO --active
Full Usage
linearis usage # Complete command reference (~1k tokens)
Output
All commands return JSON by default. Pipe to jq for processing:
linearis issues list -l 5 | jq '.[].identifier'
Priority Values
- 0: No priority
- 1: Urgent
- 2: High
- 3: Medium
- 4: Low
Links
Comments
Loading comments...
