ClawHub
Back to skill

Security audit

Linear同步(免费版)

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Linear CLI helper, but it can create lasting Linear issues through an authenticated account without clear confirmation or tight activation limits.

Install only if you intend to let the agent run authenticated Linear CLI commands. Use a least-privilege Linear API key, restrict use to Linear-specific requests, and require an explicit preview and confirmation before any issue creation command is run.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The skill is described with broad activation guidance around project management, planning, progress tracking, and collaboration, which can cause an agent to invoke an EXEC-capable skill in situations where external side effects are not clearly intended. In this context, overbroad routing increases the chance of unnecessary command execution and unintended access to Linear workspace data.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The keyword coverage section contains a very broad list of generic trigger terms, including common workflow words that are not specific to Linear. For an MD+EXEC skill, this materially raises the risk of accidental activation and unintended execution of commands against an authenticated third-party service.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill documents task creation against an external project-management system without warning that this changes shared organizational data. In an agent setting with exec and stored credentials, omission of a modification warning can lead to unauthorized or unintended creation of work items in real team workflows.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The quick-start includes a concrete issue-creation command but provides no confirmation or safety note, making it easy for an agent to perform a write action as part of example-following behavior. Because the skill is meant for automation and uses exec, examples can directly shape unsafe agent behavior toward external systems.

Session Persistence

Medium
Category
Rogue Agent
Content
linear issue list -s started
# ..
# 4. 创建简单任务
linear issue create -t "修复登录bug" -d "用户无法通过SSO登录"
# ..
# 5. 查看团队列表
linear team list
Confidence
67% confidence
Finding
create -t "修复登录bug" -d "用户无法通过SSO登录" # .. # 5. 查看团队列表 linear team list ``` **响应解析**: 完成完成后,查看输出响应确认任务状态。成功时输出包含解析摘要和响应数据;失败时根据错误信息排查问题,查阅错误解析章节获取恢复步骤. ## 示例 ### 命令结构 ```bash linear <资源类型> <操作> [参数]

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.