Security audit
Security checks across malware telemetry and agentic risk
This Linear integration has a coherent purpose, but it gives webhook-triggered agent workflows unsafe local credential and posting authority that should be reviewed before use.
Install only if you are comfortable letting Linear comments trigger local agents and potentially post back to Linear with configured write credentials. Use a dedicated least-privilege Linear bot token, remove the mandatory shell command from agent prompts, validate helper-script inputs, decide whether @forge should exist, and avoid routing confidential Linear issues unless agent sessions, logs, and any forwarding destinations are approved for that data.
`;
try {
const response = await fetch('https://api.linear.app/graphql', {
method: 'POST',
headers: {
'Authorization': apiKey,`;
try {
const response = await fetch('https://api.linear.app/graphql', {
method: 'POST',
headers: {
'Authorization': apiKey,63/63 vendors flagged this skill as clean.
Detected: suspicious.env_credential_access, suspicious.potential_exfiltration