linear

SUSPICIOUS. The skill's stated purpose and permission model are coherent for a Linear integration, and its OAuth guidance is comparatively careful. The main issue is install/execution trust: it depends on a `linear` CLI whose official vendor provenance and distribution path were not verified, yet that binary brokers OAuth access and can perform write actions against Linear. With official Linear MCP endpoints but ambiguous CLI provenance, this is better classified as high supply-chain/credential-forwarding risk rather than confirmed malware.