pp-linear

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly tells the agent to ask for the user's Linear API key and to embed it verbatim into commands or env assignments (e.g., export LINEAR_API_KEY=..., linear-pp-cli auth set-api-key, claude mcp add -e), which forces the LLM to handle secrets directly.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's install steps fetch and execute remote code (e.g., "npx -y @mvanhorn/printing-press install linear cli-only" and "go install github.com/mvanhorn/printing-press-library/library/project-management/linear/cmd/linear-pp-cli@latest" and the similar linear-pp-mcp go install), meaning the skill can cause runtime retrieval and execution of external code that the skill relies on.