Security audit

Linear

Security checks for vulnerabilities and agentic risk

Overview

The skill is a legitimate Linear helper, but it needs review because it can change Linear data and its script handles user input, credentials, and local cache files unsafely.

Install only if you are comfortable giving this helper a Linear API key that can read and change your workspace. Prefer a least-privilege token, avoid using it with untrusted issue titles, comments, project names, or usernames, and consider fixing the script to use GraphQL variables, safe JSON encoding, a private cache directory, and explicit confirmation for write actions before relying on it in an agent workflow.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/linear.sh:13
Finding: GraphQL and JSON Injection Through Untrusted Command Arguments
Content: View full analysis
" >&2 exit 1 fi gql "{ projects(filter: { name: { containsIgnoreCase: \\\"$project_name\\\" } }, first: 1) { nodes { issues(first: 30, filter: { state: { type: { nin: [\\\"completed\\\", \\\"canceled\\\"] } } }) { nodes { identifier title state { name } priority priorityLabel assignee { name } } } } } }" | format_issues ``` ```bash team_key="${issue_id%%-*}" issue_num="${issue_id##*-}" gql "{ issues(filter: { number: { eq: $issue_num }, team: { key: { eq: \\\"$team_key\\\" } } }) { nodes { identifier title description state { name } priority priorityLabel assignee { name } project { name } team { name } createdAt dueDate } } }" ``` ```bash # Escape quotes in title and description title="${title//\"/\\\"}" description="${description//\"/\\\"}" result=$(gql "mutation { issueCreate(input: { teamId: \\\"$team_id\\\", title: \\\"$title\\\", description: \\\"$description\\\" }) { success issue { identifier title url } } }") ``` ```bash body="${body//\"/\\\"}" result=$(gql "mutation { commentCreate(input: { issueId: \\\"$issue_uuid\\\", body: \\\"$body\\\" }) { success comment { id } } }") ``` ```bash user_id=$(gql "{ users(filter: { name: { containsIgnoreCase: \\\"$user_name\\\" } }) { nodes { id name } } }" | jq -r '.data.users.nodes[0].id') ...[truncated 2731 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/linear.sh:13
Finding: Linear API Key Exposed in Process Command-Line Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/linear.sh:20
Finding: Predictable Shared Temporary Cache Permits Symlink-Based File Overwrite
Content: View full analysis
"$TEAMS_CACHE" } load_teams() { if [[ ! -f "$TEAMS_CACHE" ]]; then refresh_teams_cache fi cat "$TEAMS_CACHE" } ``` The cache is also refreshed directly by the `teams` command: ```bash teams) refresh_teams_cache jq -r '.data.teams.nodes[] | "\(.key)\t\(.name)"' "$TEAMS_CACHE" ;; ``` ### Technical Analysis The default cache is placed in the globally shared `/tmp` directory under a predictable name. The identifier is a non-cryptographic `cksum` value derived from the API key. The file is written using ordinary shell redirection: ```bash > "$TEAMS_CACHE" ``` Shell redirection follows symbolic links and truncates the destination before running the command. The script does not create a private cache directory, atomically reserve the filename, reject symbolic links, verify ownership, or explicitly enforce restrictive file permissions. A local attacker who can identify or observe the cache pathname can replace it with a symbolic link to another file writable by the victim. A subsequent cache refresh then truncates and overwrites the linked target with the Linear API response. The cache may also inherit permissive permissions from the caller's umask, exposing team names and internal team IDs to other local users. The checksum in the filename is not a secure keyed digest. Although it does not directly reveal the complete token, it exposes a stable token-derived value and should not be treated as secret-safe naming. ### Attack Path 1. The victim runs the Skill, or an attacker observes the predictable cache filename in the sha ...[truncated 1140 chars]
Remediation: View remediation
"$tmp_file" chmod 600 -- "$tmp_file" mv -f -- "$tmp_file" "$cache_dir/teams.json" trap - EXIT ``` - Verify that the cache directory and existing cache file are owned by the current user and are not symbolic links before use. - Do not derive public filenames from the API key. If distinct token-specific caches are required, use a cryptographic keyed digest stored only inside the private directory. - Validate a caller-supplied `LINEAR_TEAMS_CACHE` path or document that it must reside in a trusted private directory. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises shell command usage throughout the documentation but does not declare corresponding permissions, which can cause users or orchestrators to invoke command-capable behavior without an explicit trust boundary. In an agent setting, undeclared shell capability reduces transparency and weakens policy enforcement around command execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: These commands perform live mutations against Linear, including creating issues, commenting, changing status, assigning users, and reprioritizing work, but the documentation does not clearly warn that they alter external project data. In a chat-driven or agent-assisted workflow, a user may trigger irreversible or operationally disruptive changes without realizing the commands are not read-only.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The Git workflow includes commands that modify local repository state, create branches and worktrees, and push to a remote origin, but it lacks an explicit warning that these actions change both local and remote git state. In an agent context, this can lead to unintended branch creation, pushes, or repository drift if a user assumes the workflow is informational rather than mutating.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script exposes multiple state-changing operations (create, comment, status, priority, assign) that immediately perform remote GraphQL mutations against Linear with no dry-run, confirmation prompt, or explicit warning. In an agent-skill context, this increases the chance of unintended changes from mis-parsed inputs, prompt injection, or operator mistakes, because successful execution directly alters external project data.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.