role-creator

The fragment is a configuration file with no direct evidence of malware or intentional sabotage. It creates meaningful supply-chain and credential-exposure risk by automatically executing an unpinned npx package and providing it with LINEAR_API_KEY while network and shell capabilities are enabled. Pin the MCP package to a trusted version or integrity-verified artifact, minimize permissions, and provide credentials only to verified integrations.