ClawHub

Linear 1.0.0

v1.0.0

Query and manage Linear issues, projects, and team workflows.

⭐ 0· 145·1 current·1 all-time
by@terryren2024
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
ℹ
Purpose & Capability
The skill's name and description match its behavior: the script wraps the Linear GraphQL API and performs issue/project/team operations. Requested env var (LINEAR_API_KEY) is expected. Minor inconsistency: the registry metadata lists no required binaries, but the script requires curl and jq (and the SKILL.md examples reference gh for PR creation). Confirm curl/jq are available or update metadata.
ℹ
Instruction Scope
SKILL.md instructs the agent to run the included bash script which performs only GraphQL requests to api.linear.app and local caching of team data in /tmp. The instructions do not request unrelated system files or external endpoints. Note: the skill listing in this evaluation shows the script output truncated — review the full scripts/linear.sh file before trusting it to ensure there is no unexpected code beyond the displayed portion.
✓
Install Mechanism
No install spec (instruction-only with an included script). Nothing is downloaded from third-party URLs or written during an install step. Risk is limited to the content of the provided script which will run when invoked.
ℹ
Credentials
Only LINEAR_API_KEY is required by the skill (optional LINEAR_DEFAULT_TEAM and LINEAR_TEAMS_CACHE are referenced). That is proportionate to the described functionality. The script derives a cache filename from a checksum of the API key and stores cached team data under /tmp; this is local storage and not an exfiltration channel, but it does create files named from a checksum of your key. Ensure you only provide a key with minimal necessary scopes.
✓
Persistence & Privilege
The skill is not always-enabled and does not request elevated or persistent platform privileges. It writes a teams cache to /tmp (scoped to the API key checksum) but does not modify other skills or system configs.
Assessment
What to check before installing: - Review the full scripts/linear.sh file (the manifest view here was truncated) to ensure there is no unexpected behavior or hidden endpoints. - Confirm curl and jq are present on the host (the script requires them) and update the skill metadata if needed. - Verify the LINEAR_API_KEY you supply has the minimal scopes needed (use a limited-scope token) because the script sends that key in Authorization headers to api.linear.app. - Be aware the script caches team data in /tmp using a checksum-derived filename based on the API key; this cache is local but you may want to control its location via LINEAR_TEAMS_CACHE if you have security policies about /tmp contents. - Check the owner/source (homepage is correct for Linear, but ownerId in _meta.json differs from the registry owner id shown) — prefer skills from a known repository or vendor when possible. - If you plan to allow autonomous agent invocation, remember the agent could call these operations automatically; limit the API key scope accordingly. If anything in the full script looks unexpected, do not install.

Like a lobster shell, security has layers — review code before you run it.

latestvk9780g8184z5nacmtc3ydpfb5182ztrx

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📊 Clawdis
EnvLINEAR_API_KEY

Comments