Security audit

Linear Pilot Ai Free

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed Linear automation guide, but it can automatically change Linear issues, send notifications, and push Git changes without clear confirmation or data-sharing boundaries.

Review before installing. Use least-privilege Linear credentials, avoid sensitive issue contents in forwarded webhook payloads, verify webhook authentication, keep Git autoPush disabled until tested, and require manual approval before comments, status changes, Discord messages, commits, or pushes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Scope Creep

High

Confidence: 95% confidence
Finding: The skill declares only `read` and `exec`, yet its documented behavior includes creating and modifying local config files, performing `git add/commit/push`, and invoking scripts that call external APIs. This creates a capability mismatch that can cause an agent or user to underestimate the real side effects, leading to unauthorized file changes or remote state changes when the skill is executed.

Scope Creep

High

Confidence: 93% confidence
Finding: The workflow instructs users to forward Linear issues through Make.com via HTTP to an Agent endpoint and to use scripts that interact with Linear, Discord, and possibly Git remotes, but these outbound interactions are not transparently reflected in the skill's permission model. Hidden or under-declared network behavior is dangerous because task contents, metadata, and automation results may be transmitted to third-party services without clear security boundaries.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger condition is broad enough to match many generic integration, webhook, and automation requests, increasing the chance the skill is invoked in contexts the user did not specifically intend. In this skill, unintended invocation is more dangerous because execution can cause status changes, notifications, and git operations rather than just producing passive output.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill describes automatically updating issue status, sending notifications, and committing/pushing code, all of which can alter external systems and repositories, but it does not require explicit confirmation or present concrete risk warnings before those actions occur. This is dangerous because automated writes to project management systems and source control can leak work, corrupt workflow state, or push unintended changes to shared remotes.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The webhook design forwards task data from Linear through Make.com to an Agent endpoint, but the documentation does not warn that issue content, identifiers, and possibly user data may be exposed to third-party processors. In an automation skill handling work items, this materially increases privacy and confidentiality risk, especially if issues contain internal project details or sensitive data.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.