linear

SUSPICIOUS. The skill’s purpose is coherent for Linear task management, and its stated API destinations align with official Linear endpoints. However, it preferentially executes a likely third-party `linear` CLI and may hand that tool OAuth tokens or API keys, which is disproportionate trust for a non-official binary. No direct exfiltration or overtly malicious behavior is evident, but external CLI provenance and credential forwarding make this medium-high risk.