Interact with Linear for issue tracking. Use when creating, updating, listing, or searching issues. Supports viewing assigned issues, changing status, adding comments, and managing tasks.

This skill appears to be a straightforward Linear CLI wrapper, but there are some gaps you should address before installing or running it: - The skill requires a Linear API key (LINEAR_API_KEY or ~/.clawdbot/credentials/linear.json) even though the registry metadata doesn't declare it. Do not supply a high-privilege API key until you verify the author and intended usage. Prefer a token with minimal scopes. - The shell script depends on command-line tools (curl, jq, column). Make sure those are available and from trusted packages on your system. - The script builds GraphQL payloads by directly interpolating user input into JSON/GraphQL strings. That can break with quotes/newlines and could be abused if untrusted input is fed into the skill. Review and test with safe inputs; consider sanitizing/escaping values in the script before use. - The package contains Node-related files (package.json / package-lock.json) but the runtime is a shell script; verify whether any Node code is intended to be executed and whether an install step is required. If you want to proceed: 1) obtain a Linear API key with minimal permissions, 2) manually inspect scripts/linear.sh (or run it in a sandbox), 3) add the declared requirement for the API key and CLI tools to the skill metadata or request the author to update the package metadata to match runtime needs. If you cannot validate the author or the repository origin, consider not installing or running it on sensitive accounts.

Type: OpenClaw Skill Name: linear-issues Version: 1.0.0 The skill's core script, `scripts/linear.sh`, constructs GraphQL queries by directly embedding user-provided arguments (such as issue titles, descriptions, search terms, and comment bodies) into the JSON query string without proper sanitization. This creates a GraphQL injection vulnerability, which could allow a malicious actor to alter the intended API call, potentially leading to unauthorized data access or manipulation within the Linear API. While the skill's stated purpose is benign, this implementation flaw represents a significant security risk.