ClawHub
Back to skill

Security audit

Linearis

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Linear CLI helper, but it asks users to install an unpinned global CLI and use a Linear API token for write/delete operations without enough safety guidance.

Review this before installing. Use a least-privilege Linear token, avoid putting the token directly in shell history or command-line flags, store it with restrictive permissions or a secret manager, and confirm every create, update, delete, upload, or download action before letting an agent run it. Consider pinning and independently verifying the npm package version before global installation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:15
Finding

Unpinned Global Installation of a Third-Party CLI

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 15
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: High

Complete Code Snippet:

bash
npm install -g linearis

The package is also declared without a version constraint in the metadata at line 4:

yaml
metadata: {"clawdbot":{"emoji":"📋","requires":{"bins":["linearis"]},"install":[{"id":"npm","kind":"node","package":"linearis","bins":["linearis"],"label":"Install linearis (npm)"}]}}

Technical Analysis

The installation instruction retrieves the current linearis release from npm without pinning a reviewed version or verifying an integrity hash. A global npm installation can run package lifecycle scripts and place an executable in a shared command path. Consequently, the code executed during installation and subsequent CLI use may differ from the code that existed when this Skill was audited.

This CLI is intended to receive a Linear API token and perform read and write operations against Linear workspace resources. A malicious package release could therefore execute arbitrary code with the installing user's operating-system privileges, inspect local files and environment variables, intercept the API token, or alter data returned to the invoking agent.

Attack Path

  1. An attacker compromises the npm package, a maintainer account, or its publication pipeline.
  2. The attacker publishes a malicious package version under the legitimate package name.
  3. A user follows the documented npm install -g linearis instruction.
  4. npm resolves the unpinned dependency to the malicious release.
  5. Malicious lifecycle or CLI code executes with the user's local privileges.
  6. The package captures the Linear API token when supplied through the token file, environment variable, or command-line option.
  7. The attacker uses the token to access or modify Linear resources within the token's authorized scope.

I

...[truncated 551 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the package to a specific, reviewed version instead of resolving the latest release, for example linearis@<reviewed-version>.
  • Verify package provenance, maintainer identity, release signatures, and npm registry metadata before installation.
  • Use lockfiles and integrity hashes where the installation workflow supports them.
  • Prefer a project-local, isolated installation over a global installation.
  • Disable npm lifecycle scripts when they are unnecessary and compatibility has been validated.
  • Run the CLI in a sandbox or container with only the files and network access required for Linear operations.
  • Provide the CLI with a least-privilege Linear token and rotate it immediately if dependency compromise is suspected.
  • Establish a controlled dependency update process in which each new release is reviewed before the pinned version is changed.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:19
Finding

Linear API Token May Be Exposed Through Shell History and File Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 19
Vulnerability Type: Insecure plaintext credential handling
Risk Level: Medium

Complete Code Snippet:

bash
echo "lin_api_..." > ~/.linear_api_token

Technical Analysis

The recommended command embeds the API token directly in an interactive shell command. Depending on shell configuration, the complete command may be retained in shell history or captured by terminal logging and auditing systems.

The command also creates the token file without explicitly setting restrictive permissions. Its resulting mode depends on the user's current umask. Under a permissive configuration, another local user may be able to read the plaintext token. The token remains stored unencrypted in the user's home directory until it is removed or rotated.

Attack Path

  1. A user substitutes a real Linear API token into the documented command and executes it.
  2. The shell records the command, including the token, in its history, or another logging mechanism captures it.
  3. Alternatively, a permissive umask creates ~/.linear_api_token with permissions that allow unintended local access.
  4. Another local principal, support process, backup reader, or account intruder reads the history entry or token file.
  5. The attacker authenticates to Linear using the recovered token.
  6. The attacker reads or modifies workspace resources permitted by the token.

Impact Assessment

Exploitation exposes the privileges assigned to the compromised Linear API token. Depending on its scope and the associated account, an attacker may list or search issues, read confidential issue details and documents, create comments, update issues, upload or download files, and delete or modify documents. The issue does not by itself grant operating-system privilege escalation, but it can expose workspace data and enable unauthorized actions under the victim's Linear identity.

Remediation
View remediation

Remediation Suggestions

  • Avoid placing the token directly in a shell command where it may be written to history.

  • Prompt for the credential without terminal echo, then write it under a restrictive umask, for example:

    bash
    umask 077
read -rsp "Linear API token: " LINEAR_API_TOKEN
printf '%s' "$LINEAR_API_TOKEN" > ~/.linear_api_token
unset LINEAR_API_TOKEN
chmod 600 ~/.linear_api_token

  • Prefer an operating-system credential store or dedicated secret manager over a plaintext file.

  • Ensure the token file is owned by the intended user and has mode 0600.

  • Use a least-privilege token restricted to the minimum necessary Linear access.

  • Do not pass tokens through command-line flags because process listings and logs may expose command arguments.

  • Document token rotation and revocation procedures and rotate any token suspected of appearing in shell history, logs, or backups.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The authentication section tells users to place a long-lived API token in a shell environment variable or a file under the home directory, but provides no warning about secret leakage, file permissions, shell history, or avoiding echoing tokens in shared environments. In agent-driven workflows, such credentials may be exposed through logs, prompt transcripts, command history, or overly broad filesystem access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill prominently documents state-changing and destructive operations such as creating, updating, and deleting issues/documents, but does not warn an agent or user to confirm intent before executing them. In an LLM-agent context, that increases the risk of unintended writes or deletions from ambiguous prompts, misuse of retrieved text as instructions, or accidental automation against production Linear data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.