Skills linear-claude-skill
📦
linear-claude-skill
Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables
Manage Linear Workflows with Claude
Teams lose time when issue updates, project links, and status changes are handled manually. This skill gives Claude, Codex, and Claude Code structured Linear workflows using MCP, CLI, and helper-script patterns.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "linear-claude-skill" from https://skillstore.io/skills/sickn33-linear-claude-skill.md and its manifest at https://skillstore.io/api/skills/sickn33-linear-claude-skill/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "linear-claude-skill". Create a Linear project plan for a checkout refactor.
Expected outcome:
- A project name and initiative link recommendation.
- A parent issue with clear acceptance criteria.
- A set of sub-issues with labels and suggested starting states.
Using "linear-claude-skill". Mark ENG-101, ENG-102, and ENG-103 as complete.
Expected outcome:
- A confirmation summary of the requested status changes.
- A reminder to verify issue identifiers before bulk updates.
- A short completion report suitable for a project update.
Using "linear-claude-skill". Help me check Linear API setup safely.
Expected outcome:
The response uses masked validation steps and avoids printing environment values or secret files.
Security Audit
High Riskv4 • 7/7/2026 Open versioned report
Many static command hits are Markdown examples or normal Linear workflow guidance. Confirmed risks include shell execution, hidden home-directory scripts, and persistent Linear API key storage. I found no prompt injection text or unrelated network destinations beyond Linear services.
1
Files scanned
544
Lines analyzed
38
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Environment file access
echo 'LINEAR_API_KEY=lin_api_your_key_here' >> ~/.claude/.env
The command appends the Linear API key value to ~/.claude/.env. Writing secrets to a hidden environment file is sensitive file access.
High
Unpackaged Local Script Execution
The skill tells agents to run relative scripts such as scripts/linear-ops.ts and scripts/linear-helpers.mjs. The audited package contains only SKILL.md, so those paths can resolve to unaudited workspace files.
The file tree lists only SKILL.md, while the cited lines call relative script paths. This supports workspace path-confusion risk.
Capability review items (38)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Ruby/shell backtick execution
```bash
The skill instructs agents to run npx tsx against scripts under ~/.claude, a hidden home-directory path outside the audited package. That can execute unaudited local code.
High
Ruby/shell backtick execution
```bash
The shell block includes commands that persist a Linear API key into shell or Claude environment files. This is real command execution with credential-handling risk.
High
Ruby/shell backtick execution
```bash
The skill instructs agents to run npx tsx against scripts under ~/.claude, a hidden home-directory path outside the audited package. That can execute unaudited local code.
High
Ruby/shell backtick execution
```bash
The skill instructs agents to run npx tsx against scripts under ~/.claude, a hidden home-directory path outside the audited package. That can execute unaudited local code.
High
Hidden file in home directory
npx tsx ~/.claude/skills/linear/scripts/setup.ts
The skill instructs execution of a script from ~/.claude/skills/linear, which is outside the audited package. That hidden-path dependency can execute unaudited local code.
High
Hidden file in home directory
echo 'LINEAR_API_KEY=lin_api_your_key_here' >> ~/.claude/.env
The command writes a Linear API key value into ~/.claude/.env. Persisting secrets in a hidden home file is security relevant even if intended for setup.
High
Hidden file in home directory
npx tsx ~/.claude/skills/linear/scripts/query.ts "query { viewer { name } }"
The skill instructs execution of a script from ~/.claude/skills/linear, which is outside the audited package. That hidden-path dependency can execute unaudited local code.
High
Hidden file in home directory
npx tsx ~/.claude/skills/linear/scripts/query.ts "query { viewer { name } }"
The skill instructs execution of a script from ~/.claude/skills/linear, which is outside the audited package. That hidden-path dependency can execute unaudited local code.
High
Hidden file access
npx tsx ~/.claude/skills/linear/scripts/setup.ts
The skill instructs execution of a script from ~/.claude/skills/linear, which is outside the audited package. That hidden-path dependency can execute unaudited local code.
High
Hidden file access
echo 'LINEAR_API_KEY=lin_api_your_key_here' >> ~/.claude/.env
The command writes a Linear API key value into ~/.claude/.env. Persisting secrets in a hidden home file is security relevant even if intended for setup.
High
Hidden file access
npx tsx ~/.claude/skills/linear/scripts/query.ts "query { viewer { name } }"
The skill instructs execution of a script from ~/.claude/skills/linear, which is outside the audited package. That hidden-path dependency can execute unaudited local code.
High
Hidden file access
npx tsx ~/.claude/skills/linear/scripts/query.ts "query { viewer { name } }"
The skill instructs execution of a script from ~/.claude/skills/linear, which is outside the audited package. That hidden-path dependency can execute unaudited local code.
High
Generic API/secret keys
export LINEAR_API_KEY="lin_api_your_key_here"
The setup example asks users to export a Linear API key in a shell-profile context. It uses a placeholder, but it encourages persistent credential storage.
High
Generic API/secret keys
echo 'LINEAR_API_KEY=lin_api_your_key_here' >> ~/.claude/.env
The command appends a Linear API key value to ~/.claude/.env. That is credential persistence in a hidden file and should be treated as security relevant.
High
Generic API/secret keys
"env": { "LINEAR_API_KEY": "your_api_key" }
The MCP configuration example places the API key directly in configuration. Even as a placeholder, it encourages inline credential storage rather than secret injection.
Medium
Ruby/shell backtick execution
2. **Linear CLI (`linear` command)** - Always available via Bash
The skill directs agents to run CLI or Node commands that can read or modify Linear data. These are intended workflows, but they are real external commands with side effects.
Medium
Ruby/shell backtick execution
```bash
The skill directs agents to run CLI or Node commands that can read or modify Linear data. These are intended workflows, but they are real external commands with side effects.
Medium
Ruby/shell backtick execution
```bash
The skill instructs agents to run shell commands such as varlock, npx, grep, and cat. The intent is legitimate secret handling, but external command execution is real.
Medium
Ruby/shell backtick execution
```
The skill instructs agents to run shell commands such as varlock, npx, grep, and cat. The intent is legitimate secret handling, but external command execution is real.
Medium
Ruby/shell backtick execution
4. Use `varlock load` to validate before operations
The skill instructs agents to run shell commands such as varlock, npx, grep, and cat. The intent is legitimate secret handling, but external command execution is real.
Medium
Ruby/shell backtick execution
```bash
The skill directs agents to run CLI or Node commands that can read or modify Linear data. These are intended workflows, but they are real external commands with side effects.
Medium
Ruby/shell backtick execution
```bash
The skill directs agents to run CLI or Node commands that can read or modify Linear data. These are intended workflows, but they are real external commands with side effects.
Medium
Ruby/shell backtick execution
```bash
The skill directs agents to run CLI or Node commands that can read or modify Linear data. These are intended workflows, but they are real external commands with side effects.
Medium
Ruby/shell backtick execution
```bash
The skill directs agents to run CLI or Node commands that can read or modify Linear data. These are intended workflows, but they are real external commands with side effects.
Medium
Ruby/shell backtick execution
```bash
The skill directs agents to run CLI or Node commands that can read or modify Linear data. These are intended workflows, but they are real external commands with side effects.
Medium
Ruby/shell backtick execution
```bash
The skill directs agents to run CLI or Node commands that can read or modify Linear data. These are intended workflows, but they are real external commands with side effects.
Medium
Ruby/shell backtick execution
```bash
The skill directs agents to run CLI or Node commands that can read or modify Linear data. These are intended workflows, but they are real external commands with side effects.
Medium
Ruby/shell backtick execution
```bash
The skill directs agents to run CLI or Node commands that can read or modify Linear data. These are intended workflows, but they are real external commands with side effects.
Medium
Ruby/shell backtick execution
```bash
The skill directs agents to run CLI or Node commands that can read or modify Linear data. These are intended workflows, but they are real external commands with side effects.
Medium
Ruby/shell backtick execution
```bash
The skill directs agents to run CLI or Node commands that can read or modify Linear data. These are intended workflows, but they are real external commands with side effects.
Medium
Ruby/shell backtick execution
```bash
The skill directs agents to run CLI or Node commands that can read or modify Linear data. These are intended workflows, but they are real external commands with side effects.
Medium
Ruby/shell backtick execution
```bash
The skill directs agents to run CLI or Node commands that can read or modify Linear data. These are intended workflows, but they are real external commands with side effects.
Medium
Ruby/shell backtick execution
```json
The MCP configuration launches npx mcp-remote and connects to Linear. This is intentional, but it executes an external tool and opens network access.
Medium
Ruby/shell backtick execution
```bash
The skill directs agents to run CLI or Node commands that can read or modify Linear data. These are intended workflows, but they are real external commands with side effects.
Medium
Ruby/shell backtick execution
```bash
The skill directs agents to run CLI or Node commands that can read or modify Linear data. These are intended workflows, but they are real external commands with side effects.
Medium
Ruby/shell backtick execution
```bash
The skill directs agents to run CLI or Node commands that can read or modify Linear data. These are intended workflows, but they are real external commands with side effects.
Medium
Ruby/shell backtick execution
```bash
The skill directs agents to run CLI or Node commands that can read or modify Linear data. These are intended workflows, but they are real external commands with side effects.
Low
Hardcoded URL
"args": ["mcp-remote", "https://mcp.linear.app/sse"],
The MCP example hardcodes the official Linear MCP endpoint and would send traffic to Linear. This is expected for the skill, but network access is real.
Risk Factors
⚙️ External commands (76)
SKILL.md:26 SKILL.md:31-46 SKILL.md:46-64 SKILL.md:64-73 SKILL.md:73-77 SKILL.md:77-83 SKILL.md:83-87 SKILL.md:87 SKILL.md:88-91 SKILL.md:91-93 SKILL.md:93 SKILL.md:96-104 SKILL.md:104-106 SKILL.md:106-116 SKILL.md:116-118 SKILL.md:118-132 SKILL.md:132-135 SKILL.md:135-143 SKILL.md:143-149 SKILL.md:149-151 SKILL.md:151-157 SKILL.md:157-172 SKILL.md:172-193 SKILL.md:193-195 SKILL.md:195-198 SKILL.md:198-200 SKILL.md:200-203 SKILL.md:203-207 SKILL.md:207-210 SKILL.md:210-212 SKILL.md:212-224 SKILL.md:224-228 SKILL.md:228-238 SKILL.md:238-240 SKILL.md:240-245 SKILL.md:245-246 SKILL.md:246-247 SKILL.md:247-248 SKILL.md:248-249 SKILL.md:249-250 SKILL.md:250-253 SKILL.md:253-262 SKILL.md:262-268 SKILL.md:268-270 SKILL.md:270-273 SKILL.md:273-279 SKILL.md:279-285 SKILL.md:285-287 SKILL.md:287-290 SKILL.md:290-296 SKILL.md:296-304 SKILL.md:304-326 SKILL.md:326-349 SKILL.md:349-351 SKILL.md:351-361 SKILL.md:361-370 SKILL.md:370-376 SKILL.md:376-382 SKILL.md:382-390 SKILL.md:390-392 SKILL.md:392-398 SKILL.md:398-400 SKILL.md:400-433 SKILL.md:433-434 SKILL.md:434-441 SKILL.md:441 SKILL.md:442 SKILL.md:443 SKILL.md:445-451 SKILL.md:451-455 SKILL.md:455 SKILL.md:476-478 SKILL.md:478-486 SKILL.md:486-497 SKILL.md:497-522 SKILL.md:522-528
🌐 Network access (4)
📁 Filesystem access (10)
🔑 Env variables (9)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-linear-claude-skill/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-linear-claude-skill?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-linear-claude-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-linear-claude-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-linear-claude-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). linear-claude-skill security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-linear-claude-skill/audits/4BibTeX citation
@techreport{sickn33-sickn33-linear-claude-skill-2026,
author = {sickn33},
title = {linear-claude-skill security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/sickn33-linear-claude-skill/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "linear-claude-skill security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/sickn33-linear-claude-skill/audits/4"
identifiers:
- type: other
value: "skillstore:sickn33-linear-claude-skill:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
69
Community
78
Spec Compliance
What You Can Build
Coordinate Sprint Issue Updates
Update issue status, add comments, and list assigned work during sprint execution.
Create Project Plans
Create projects, add parent issues, create sub-issues, and link work to initiatives.
Automate Linear Cleanup
Plan bulk status changes, label checks, and project lifecycle updates after code changes.
Try These Prompts
Check My Linear Setup
Check whether my Linear access is ready. Use safe validation steps and do not reveal any API key values.
Create Issues for a Feature
Create a Linear plan for this feature: [describe feature]. Include a parent issue, sub-issues, labels, and the right project link.
Update Project Progress
Review these Linear issues: [issue keys]. Move completed work to Done, add a short status comment, and summarize anything blocked.
Design a Bulk Sync Workflow
Plan a safe bulk Linear sync for these code changes: [change summary]. Include validation, confirmation points, and rollback notes.
Best Practices
- Prefer the official Linear MCP server when it is available and configured.
- Confirm issue keys, project names, and initiative links before making bulk changes.
- Use masked secret validation and avoid printing environment variables.
Avoid
- Do not print API keys, environment files, or Linear CLI configuration output.
- Do not create issues in a holding project and move them later.
- Do not run helper scripts from untrusted or unknown workspace paths.
Frequently Asked Questions
What does this skill help manage?
It helps manage Linear issues, projects, initiatives, labels, status updates, and bulk workflow planning.
Does it require Linear credentials?
Yes. It requires a Linear API key or an authenticated Linear MCP setup.
Can it use Claude Code and Codex?
Yes. The report marks support for Claude, Codex, and Claude Code.
Can it make changes in Linear?
Yes. Several workflows can create issues, update status, add comments, and change project links.
Are helper scripts included?
No. The audited package only includes SKILL.md, so referenced scripts must be supplied separately.
How should secrets be handled?
Use masked validation and environment references. Avoid printing keys or writing raw secrets into shared files.
Developer Details
Author
sickn33License
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/linear-claude-skillRef
816c62b2546ddb1c6a0453e7c781b5e095117819
Maintenance freshness
7/18/2026
Usage
7 downloads · 106 views
File structure
📄 SKILL.md