Security audit

Linear

Security checks for vulnerabilities and agentic risk

Overview

The Linear skill is mostly coherent, but its setup instructions ask agents to run unverified remote installer scripts and it includes broad Linear write/delete authority.

Review this skill before installing. It can read and modify Linear data available to the connected account, including destructive changes and raw GraphQL mutations, so only approve writes after seeing the exact target and payload. Avoid running the provided pipe-to-shell installer commands unless you independently trust and verify the OOMOL installer; prefer a signed, pinned, or manually inspected installation path.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:88
Finding: Unverified Remote Installer Download and Immediate Execution## Vulnerability Details **File Location**: `SKILL.md:88` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The documented installation command downloads a shell script from an external URL and pipes it directly into Bash. The remote script is not version-pinned, saved for inspection, checked against a cryptographic digest, or verified using a digital signature. Although the URL uses HTTPS and belongs to the vendor identified by the Skill, HTTPS does not establish that the retrieved script is immutable or safe. The effective payload can change after this Skill has been reviewed. Compromise of the hosting service, release pipeline, vendor account, DNS infrastructure, or relevant TLS trust chain could cause attacker-controlled code to execute locally. Installation is presented as a fallback when the `oo` command is unavailable rather than as part of every invocation. Nevertheless, installing a required CLI is legitimate functionality that can be implemented without immediate execution of mutable remote content. This mechanism therefore exceeds the minimum risk necessary for setup. ### Attack Path 1. An attacker compromises the installer host, its deployment pipeline, or another component capable of changing the response from `https://cli.oomol.com/install.sh`. 2. A user or Agent encounters an `oo: command not found` error and follows the documented first-time setup procedure. 3. `curl` retrieves the modified script and streams it directly to Bash. 4. Bash executes the payload without an integrity or authenticity check. 5. The payload performs arbitrary actions under the privileges of the account running the command. ### Impact Assessment Successful exploitation provides arbitrary code execution with the invoking user's privileges. The resulting scope may includ ...[truncated 545 chars]
Remediation: ## Remediation Suggestions - Replace the pipe-to-shell command with installation through a trusted, version-pinned package manager or a specific immutable release artifact. - Download the installer to a local file before execution so it can be inspected. - Publish and require verification of a cryptographic checksum obtained through an independently protected channel. - Prefer digital signature verification using a documented vendor signing key. - Pin the expected CLI version instead of continuously retrieving mutable content from a generic installer URL. - Run installation with ordinary user privileges unless a narrowly defined operation explicitly requires elevation. - Document the files, directories, network destinations, and configuration changes expected from installation.

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:92
Finding: Unverified PowerShell Installer Download and Immediate Execution## Vulnerability Details **File Location**: `SKILL.md:92` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The Windows setup command uses `Invoke-RestMethod` (`irm`) to retrieve mutable PowerShell source code and passes it directly to `Invoke-Expression` (`iex`). This executes the response as code without pinning a release, verifying a checksum or signature, or allowing prior inspection. The vendor-aligned HTTPS URL reduces some transport risks but does not protect against compromise of the vendor's hosting or publication infrastructure and does not make the payload immutable. A later change to the remote response changes what users execute without requiring any change to the reviewed Skill. This installation mechanism is not necessary to provide the declared Linear connector functionality: a signed and versioned package or separately downloaded and verified installer would achieve setup with a substantially smaller supply-chain risk. ### Attack Path 1. An attacker gains the ability to alter the content returned by `https://cli.oomol.com/install.ps1`, such as through compromise of the hosting account or deployment pipeline. 2. A Windows user or Agent encounters a missing `oo` command and follows the documented setup instruction. 3. `Invoke-RestMethod` downloads the attacker-controlled PowerShell source. 4. `Invoke-Expression` immediately evaluates it in the current PowerShell process without integrity verification. 5. The payload executes arbitrary commands with the current user's privileges. ### Impact Assessment Successful exploitation enables arbitrary PowerShell execution as the invoking user. Potential impact includes access to user-readable files and credentials, modification of user configuration, downloading further payloads, and misuse of ...[truncated 378 chars]
Remediation: ## Remediation Suggestions - Distribute the Windows CLI as a version-pinned, Authenticode-signed package or installer from a documented release. - Download the artifact separately and validate its publisher signature and cryptographic digest before running it. - Avoid `Invoke-Expression` for remotely obtained content. - Publish expected checksums through an independently protected release channel. - Use a trusted package manager with package-signing and version-pinning support where possible. - Install with least privilege and document all expected system changes.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

Category: Supply Chain
Content: - **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell
Confidence: 96% confidence
Finding: The skill instructs the agent to install software via a remote script piped directly into a shell (`curl ... | bash`), which is a classic supply-chain risk. If the remote host, DNS, TLS trust chain, or installation script is compromised, arbitrary code would execute immediately on the user's system with the agent facilitating it.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: The skill description says to use this skill for ANY Linear request, which is an overly broad trigger that can cause the agent to invoke the skill whenever Linear is mentioned, even if the user did not intend tool use. In a skill that includes write and destructive actions, unintended invocation increases the chance of unnecessary data access or state-changing operations being prepared or executed.

Static analysis

No suspicious patterns detected.