Linear Pilot Ai Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.0

Overview

The skill openly automates Linear tasks, but it needs Review because webhook-triggered work can update Linear and push Git changes without clear authentication, scoping, or approval safeguards.

Install only if you can tightly control who can create or move Linear issues into the monitored state, use a least-privileged Linear API key, protect or replace the plaintext env-file secret setup, disable direct auto-push unless you have a reviewed branch workflow, and require manual approval before code changes, script execution, or Git pushes.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:105

Finding

Untrusted Linear Tasks Can Trigger Broad Agent Actions and Automated Git Pushes

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:27

Finding

Linear API Key Setup Can Expose Credentials Through Shell History and File Permissions

Content

View full analysis

~/.linear-pilot/linear.env chmod 600 ~/.linear-pilot/linear.env ``` The repeated setup procedure at `SKILL.md:165-168` omits the permission-hardening command: ```bash mkdir -p ~/.linear-pilot echo "LINEAR_API_KEY=lin_api_your_key_here" > ~/.linear-pilot/linear.env ``` ### Technical Analysis The instructions encourage users to substitute a real Linear API key directly into an interactive shell command. Interactive shells commonly persist entered commands in history files. File mode `600` protects the resulting environment file but does not remove the key from shell history, terminal logs, session recording, process auditing, or copied command transcripts. The second setup example writes the key without explicitly setting restrictive permissions. Its resulting permissions depend on the user's current `umask`, and the file may temporarily or permanently be readable by unintended local users or processes. The document states that the configuration is ignored by Git, but the audited package contains only `SKILL.md`; no `.gitignore` file is present to substantiate that protection. In addition, a global home-directory file is not protected merely by adding a repository-relative ignore rule. ### Attack Path 1. A user copies the documented command and replaces the placeholder with a valid Linear API key. 2. The shell records the full command, including the key, in its history or associated terminal logging. 3. Alternatively, the user follows the repeated example that omits `chmod 600`, leaving permissions determined by the environment's `umask`. 4. Another local user, support process, backup, history synchronization service, or unauthorized ...[truncated 981 chars]

Remediation

View remediation

"$HOME/.linear-pilot/linear.env" unset LINEAR_API_KEY chmod 600 "$HOME/.linear-pilot/linear.env" ``` 4. **Prefer a managed secret store** - Use the operating system's credential manager, a deployment secret store, or the agent platform's protected secret facility. - Inject the credential only into the process that requires it. 5. **Reduce credential impact** - Use the least-privileged credential available. - Use separate credentials for development and production automation. - Rotate the key after suspected exposure. - Monitor Linear API activity for unexpected operations. 6. **Correct the Git protection guidance** - Do not claim the directory is already ignored unless an applicable ignore configuration is supplied and verified. - Clarify that secrets stored under the user's home directory must remain outside repositories. - Add secret scanning as a secondary control rather than relying solely on `.gitignore`. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill promotes automatic processing, status changes, and Git synchronization without prominently warning that it can modify external systems autonomously. This creates a real risk of unintended issue transitions, misleading completion states, and unreviewed commits or pushes to repositories, especially when webhook-triggered.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

This duplicate finding points to the same persistent plaintext secret storage pattern. The risk is not the directory creation itself, but the instruction to save an active API token in a reusable local file that may be exposed through host compromise, backups, or user mishandling.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

bash

# 创建配置目录（已gitignore）
mkdir -p ~/.linear-pilot
echo "LINEAR_API_KEY=lin_api_xxxxxxxxxxxxx" > ~/.linear-pilot/linear.env
chmod 600 ~/.linear-pilot/linear.env

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

This duplicate finding points to the same persistent plaintext secret storage pattern. The risk is not the directory creation itself, but the instruction to save an active API token in a reusable local file that may be exposed through host compromise, backups, or user mishandling.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

bash

# 创建配置目录(已gitignore)
mkdir -p ~/.linear-pilot
echo "LINEAR_API_KEY=lin_api_xxxxxxxxxxxxx" > ~/.linear-pilot/linear.env
chmod 600 ~/.linear-pilot/linear.env

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

创建配置目录（已gitignore）

mkdir -p ~/.linear-pilot echo "LINEAR_API_KEY=lin_api_xxxxxxxxxxxxx" > ~/.linear-pilot/linear.env chmod 600 ~/.linear-pilot/linear.env

text

获取API Key：Linear → Settings → API → Personal API keys

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documented webhook forwarding sends Linear issue data to an agent endpoint but does not warn about transmitting potentially sensitive project metadata to third-party infrastructure. Without privacy guidance, users may forward task contents, identifiers, and comments to services or endpoints that are not appropriately trusted or secured.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

L211 将“研究”任务的处理方式描述为“派生子Agent调研”，但 L357 的免费版限制明确写着“❌ 子Agent任务分发”。这不是简单遗漏，而是同一文档中对该技能是否具备子Agent能力的直接自相矛盾说明。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions are broad enough that users may invoke the skill for loosely related integration or webhook tasks without understanding the operational consequences. In a skill that can update external task state, send notifications, and push to Git, ambiguous invocation criteria increase the chance of unintended autonomous actions against real systems.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This duplicate quick-start instruction again normalizes persistent plaintext storage of a privileged API token. In the context of an automation skill that can act on webhooks and update external systems, credential reuse from disk meaningfully increases operational security risk.

Content

Scanner excerpt · SKILL.md (reported line 374)May include surrounding context.

Step 1：配置Linear API

bash

mkdir -p ~/.linear-pilot
echo "LINEAR_API_KEY=lin_api_your_key_here" > ~/.linear-pilot/linear.env

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This duplicate quick-start instruction again normalizes persistent plaintext storage of a privileged API token. In the context of an automation skill that can act on webhooks and update external systems, credential reuse from disk meaningfully increases operational security risk.

Content

Scanner excerpt · SKILL.md (reported line 374)May include surrounding context.

Step 1:配置Linear API

bash

mkdir -p ~/.linear-pilot
echo "LINEAR_API_KEY=lin_api_your_key_here" > ~/.linear-pilot/linear.env

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file states that the documentation and configuration examples were fully localized into Chinese to fit domestic developer habits. This indicates a language constraint in the skill materials, but there is no mention of optional language support or user opt-in for another locale.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.