ClawHub
Back to skill

Security audit

Linear Autopilot

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned, but it gives externally triggered tasks broad authority to update Linear, send Discord messages, write files, and optionally push git changes without enough review or scoping controls.

Review carefully before installing. Use this only in a tightly controlled Linear team and Discord channel, disable autoPush unless a human reviews the exact diff first, use least-privilege and rotated tokens, store secrets in a proper secret manager or locked-down file, and treat all Linear issue fields as untrusted data rather than agent instructions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:151
Finding

Untrusted Linear issue content is treated as executable agent instructions

Content
View full analysis
📋 New task: {{1.title}} Status: {{1.state.name}} ID: {{1.identifier}} ``` The Pipedream forwarding template is: ```text <@YOUR_BOT_ID> 📋 New task: {{steps.trigger.event.body.data.title}} Status: {{steps.trigger.event.body.data.state.name}} ID: {{steps.trigger.event.body.data.identifier}} ``` The Zapier webhook payload is: ```json { "content": "<@YOUR_BOT_ID>\n📋 New task: {{title}}\n Status: {{state_name}}\n ID: {{identifier}}" } ``` ### Technical Analysis Issue titles and identifiers originating in Linear are inserted directly into Discord messages. The receiving agent is then instructed to process any task arriving in that channel and to “Execute the task,” potentially using sub-agents ...[truncated 2769 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/linear-api.sh:8
Finding

Credential configuration file is executed as arbitrary shell code

Content
View full analysis
~/.clawdbot/linear.env" exit 1 fi ``` The documented setup command is: ```bash mkdir -p ~/.clawdbot echo "LINEAR_API_KEY=lin_api_xxxxx" > ~/.clawdbot/linear.env ``` ### Technical Analysis The Bash `source` builtin does not parse an environment file as passive key-value data. It evaluates the entire file as shell code in the current process. Any command substitution, function definition, redirection, shell command, or environment mutation contained in `~/.clawdbot/linear.env` therefore executes whenever the helper script runs. The script checks only whether the path is a regular file according to `-f`. It does not verify: - File ownership. - Restrictive permissions. - Whether the path is a symbolic link. - Whether the containing directory is securely owned. - That the file contains only one valid `LINEAR_API_KEY` assignment. The setup instructions also do not apply an explicit `0600` mode. The resulting permissions depend on the user’s umask, potentially exposing the Linear API key to other local users. ### Attack Path 1. An attacker gains the ability to create, replace, or modify `~/.clawdbot/linear.env`. This could result from weak file permissions, insecure restoration or synchronization, another compromised process under the same account, or unsafe directory ownership. 2. The attacker adds shell syntax to the file, for example: ```bash LINEAR_API_KEY=placeholder malicious_command ``` 3. The operator or agent runs any command from `scripts/li ...[truncated 1076 chars]
Remediation
View remediation
"$HOME/.clawdbot/linear.env" chmod 600 "$HOME/.clawdbot/linear.env" ``` 5. Verify that the configuration file and parent directory are owned by the current user. 6. Reject symbolic links and files with group or world permissions. 7. Avoid printing secrets in logs, process arguments, errors, or command histories. 8. Document credential rotation procedures in case the file was previously readable by unauthorized users. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/linear-api.sh:30
Finding

GraphQL requests are constructed using incomplete string escaping

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:169
Finding

Externally initiated task output can be committed and pushed without a review boundary

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The supplied code is narrowly focused on interacting with the Linear GraphQL API from a shell script. It can read configuration, query teams/states/issues, mark tasks in progress or done, and add comments. The declared description, however, presents a substantially broader automation skill that includes Discord notifications, DM notifications, triggering Clawdbot actions, and git sync/auto-push within a kanban-to-agent workflow. None of those capabilities appear in this code chunk. While task status updates are represented accurately, the primary purpose and major advertised integrations are missing, making the description materially broader than the actual behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill instructs the agent to run shell commands and perform state-changing operations, but it declares no explicit tool scope or permissions boundary. That increases the chance the skill will be invoked with broader shell access than users expect, especially since it also references git operations and local file writes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Claiming the skill supports 'any task type' makes invocation scope overly broad and can cause the agent to apply this workflow in inappropriate contexts. In a security-sensitive environment, ambiguous activation criteria can lead to unintended shell actions, task processing, or repository modifications outside the user's actual intent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
81% confidence
Finding

The skill directs users to persist an API key in a plaintext file under the home directory, creating a long-lived local secret that may be readable by other processes, backups, or accidental commits. Persistent storage of credentials increases exposure duration and makes later compromise more damaging.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

Run setup to store your Linear API key:

bash
mkdir -p ~/.clawdbot
echo "LINEAR_API_KEY=lin_api_xxxxx" > ~/.clawdbot/linear.env

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The workflow instructs an automatic 'git push' without prominently warning that this publishes local changes to a remote repository, potentially exposing sensitive data or unreviewed output. Because the skill is framed as a general automation pipeline, users may not realize repository contents will leave the local environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/make-setup.md (reported line 106)May include surrounding context.

  • Verify webhook URL is correct
  • Test webhook directly with curl:
    bash
    curl -X POST -H "Content-Type: application/json" \
  -d '{"content":"Test message"}' \
  YOUR_WEBHOOK_URL

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The guide tells users to connect a Discord bot using its bot token but does not warn that the token is a high-value secret that grants control of the bot. In the context of an automation workflow linking Linear, Pipedream, and Discord, mishandling that credential could let an attacker send messages as the bot, access bot-enabled workflows, or pivot into other integrated systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The guide tells users to connect Clawdbot's Discord bot token directly in Zapier but does not warn that the token is a high-sensitivity secret equivalent to bot account credentials. In this workflow context, exposing or mishandling that token could let an attacker send messages as the bot, read allowed data through the bot, or disrupt task automation across Discord-integrated operations.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/linear-api.sh (reported line 29)May include surrounding context.

sh
graphql() {
  local query="$1"
  curl -s -X POST https://api.linear.app/graphql \
    -H "Content-Type: application/json" \
    -H "Authorization: $LINEAR_API_KEY" \
    -d "{\"query\": \"$query\"}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/linear-api.sh (reported line 29)May include surrounding context.

sh
graphql() {
  local query="$1"
  curl -s -X POST https://api.linear.app/graphql \
    -H "Content-Type: application/json" \
    -H "Authorization: $LINEAR_API_KEY" \
    -d "{\"query\": \"$query\"}"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script exposes state-changing operations (start, done, and comment) directly from CLI arguments and executes them immediately against the Linear API with no confirmation, dry-run mode, or secondary validation. In an agent-driven workflow, this raises the risk of accidental or script-driven unauthorized task transitions and comment posting, which can alter project state and mislead downstream automation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.