Skills linear-milestones-write
📦
linear-milestones-write
v1.0.0 Content revision r2 High Risk 🔑 Env variables⚙️ External commands🌐 Network access📁 Filesystem access
Create and Update Linear Milestones
Managing Linear milestones manually slows release planning and creates inconsistent records. This skill provides guided CLI commands for creating and updating milestones.
Supports: Claude Codex Code(CC)
This skill is part of a pack
Install the whole pack to get every skill the task needs, in one command.
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "linear-milestones-write" from https://skillstore.io/skills/bind-linear-milestones-write.md and its manifest at https://skillstore.io/api/skills/bind-linear-milestones-write/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "linear-milestones-write". Create Alpha Release in the Mobile App project with target date 2026-09-30.
Expected outcome:
Created the Alpha Release milestone in Mobile App with target date September 30, 2026.
Using "linear-milestones-write". Rename milestone 8c43 to General Availability and move its target date to 2026-11-15.
Expected outcome:
Updated milestone 8c43. The name is General Availability, and the target date is November 15, 2026.
Security Audit
High Riskv9 • 7/23/2026 Open versioned report
The Markdown backtick and Bun URL detections are documentation syntax, not runtime execution or network requests. Credential and .env access are genuine risks, while missing executables and ambiguous project matching prevent complete assurance for write operations.
2
Files scanned
90
Lines analyzed
5
Review items
0
False positives ignored
Confirmed security concerns (4)
High
Environment file access
CLI tools for creating and updating Linear project milestones. Requires `LINEAR_API_KEY` set in `<gi
The overview identifies a repository-root .env file as a credential source. Reading that file is sensitive because it may contain additional secrets.
High
Environment file access
- `LINEAR_API_KEY` set in `<git-root>/.env` or environment
The prerequisite recommends storing LINEAR_API_KEY in .env. This creates genuine sensitive-file exposure even though it supports the stated authentication purpose.
High
Referenced Write Executables Are Missing
The manifest and instructions reference write executables absent from the audited package. Their endpoint, credential, validation, and mutation behavior cannot be verified.
The audited package contains only skill.json and SKILL.md, while both files explicitly reference executable files that are not present.
Medium
Ambiguous Project Selection for Write Operations
Case-insensitive partial project matching can resolve an unintended project and create a milestone in the wrong location unless ambiguous matches are rejected.
The documentation explicitly accepts a project name and states that project names use case-insensitive partial matching for a create operation.
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys
"env": ["LINEAR_API_KEY"],
The manifest explicitly requests LINEAR_API_KEY for authenticated Linear write operations. Access to this credential is expected but security-sensitive because misuse can alter workspace data.
High
Generic API/secret keys
CLI tools for creating and updating Linear project milestones. Requires `LINEAR_API_KEY` set in `<gi
The overview explicitly requires LINEAR_API_KEY for the write workflow. The credential can authorize changes to Linear workspace data.
High
Generic API/secret keys
- `LINEAR_API_KEY` set in `<git-root>/.env` or environment
The prerequisite explicitly requires LINEAR_API_KEY from .env or the process environment. This is direct access to a sensitive API credential.
Medium
Hidden file access
CLI tools for creating and updating Linear project milestones. Requires `LINEAR_API_KEY` set in `<gi
The skill explicitly supports loading LINEAR_API_KEY from a repository-root .env file. This is intentional hidden-file access involving credential material.
Medium
Hidden file access
- `LINEAR_API_KEY` set in `<git-root>/.env` or environment
The prerequisite directs users to place LINEAR_API_KEY in a repository-root .env file. Accessing that file exposes a local secret to the skill runtime.
Risk Factors
🔑 Env variables (3)
⚙️ External commands (22)
SKILL.md:11 SKILL.md:16 SKILL.md:22-24 SKILL.md:24-27 SKILL.md:27-28 SKILL.md:28-31 SKILL.md:31-32 SKILL.md:32-33 SKILL.md:33-36 SKILL.md:36-40 SKILL.md:40-46 SKILL.md:46-48 SKILL.md:48-51 SKILL.md:51-54 SKILL.md:54-55 SKILL.md:55-56 SKILL.md:56-57 SKILL.md:57-60 SKILL.md:60-64 SKILL.md:64-71 SKILL.md:71-72 SKILL.md:72-73
🌐 Network access (1)
📁 Filesystem access (2)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/bind-linear-milestones-write/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/bind-linear-milestones-write?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/bind-linear-milestones-write?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/bind-linear-milestones-write/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/bind-linear-milestones-write.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
Bind. (2026). linear-milestones-write security audit report (audit version 9) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/bind-linear-milestones-write/audits/9BibTeX citation
@techreport{bind-bind-linear-milestones-write-2026,
author = {Bind},
title = {linear-milestones-write security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/bind-linear-milestones-write/audits/9},
note = {Author version 1.0.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "linear-milestones-write security audit report (audit version 9)"
version: "1.0.0"
type: report
authors:
- name: "Bind"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/bind-linear-milestones-write/audits/9"
identifiers:
- type: other
value: "skillstore:bind-linear-milestones-write:audit:9"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
100
Maintainability
87
Content
70
Community
83
Spec Compliance
What You Can Build
Plan Product Releases
Create named milestones with dates and descriptions for upcoming product releases.
Adjust Delivery Dates
Update an existing milestone when release scope or scheduling changes.
Automate Milestone Workflows
Request machine-readable results for milestone creation and update tasks in controlled automation.
Try These Prompts
Create a Basic Milestone
Create a Linear milestone named [milestone name] in project [project name or UUID]. Confirm the matched project before writing.
Create a Dated Milestone
Create milestone [name] in project [project] with description [description] and target date [YYYY-MM-DD]. Show the result without exposing credentials.
Update an Existing Milestone
Update milestone [milestone UUID] with name [name], description [description], and target date [YYYY-MM-DD]. Summarize the changed fields.
Perform a Verified Update
Validate milestone UUID [UUID] and proposed values before updating. Apply only confirmed changes, request machine-readable output, and report validation failures clearly.
Best Practices
- Use exact project UUIDs when multiple project names may match.
- Review the milestone identifier and proposed changes before every write operation.
- Store LINEAR_API_KEY in a secret manager or protected environment variable.
Avoid
- Do not place LINEAR_API_KEY in prompts, logs, command history, or repository files.
- Do not rely on partial project matching when several projects have similar names.
- Do not run write commands until the referenced executables have been reviewed and installed.
Frequently Asked Questions
What can this skill change in Linear?
It documents commands to create milestones and update their names, descriptions, or target dates.
What credentials are required?
A LINEAR_API_KEY with permission to modify milestones in the target workspace is required.
Can I select a project by name?
Yes. Project names support case-insensitive partial matching, but exact UUIDs reduce ambiguity.
How do I update a milestone?
Provide the milestone UUID and at least one new value, such as its name, description, or target date.
Does the skill support automation output?
Yes. The documented JSON flag requests machine-readable output from create and update commands.
Are the executable files included?
No. The audited package references JavaScript and TypeScript executables that are not present, so their behavior cannot be verified.