Security audit

Linear工作流机器人

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Linear automation bot, but it can automatically change task state, write files, use webhooks, and push Git changes with weak scoping and inconsistent capability documentation.

Install only if you are comfortable giving the agent permission to run commands, update Linear issues, send task details to notification/webhook services, write files, and commit or push to a configured repository. Before use, set autoPush to false unless needed, restrict the repo path, use least-privilege Linear and Discord tokens, and review any generated commands or Git changes before allowing automation to run unattended.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The skill claims it is MD-only/natural-language driven in one section, while elsewhere it explicitly requires exec-based commands, webhook calls, and Git operations. This inconsistency can mislead users and security controls about the skill's actual capabilities, increasing the chance that command execution and network side effects occur without informed consent or proper review.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The security section states commands are limited to pre-approved commands and do not interpolate user input, but the documented workflow processes task-derived identifiers, summaries, file paths, and Git commit messages originating from Linear/webhook data. If downstream scripts pass these values into shell commands unsafely, users may overtrust the skill's safety guarantees and expose themselves to command or argument injection risks.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The description does not prominently warn that the workflow can automatically create files, change task state, commit changes, and push to Git repositories. Users may enable the skill expecting passive automation, but it can perform persistent and potentially irreversible modifications to local and remote resources.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill description also lacks a clear warning that task metadata and notifications are sent to third-party services including Linear, Discord, and webhook platforms. This creates data exposure and privacy risk because issue titles, comments, assignee data, and operational status may leave the local environment without the user's fully informed consent.

Session Persistence

Medium

Category: Rogue Agent
Content: tools: - read - exec - write homepage: '""' category: '"Automation"' pricing_tier: free
Confidence: 72% confidence
Finding: The skill declares write capability and documents persistent configuration and output under the user's home directory plus repository modifications. In this context, session persistence is not inherently malicious, but it is security-relevant because automation can leave durable state, alter repos, and affect later runs if users are not clearly informed and controls are weak.

Static analysis

No suspicious patterns detected.