lin

SUSPICIOUS. The documented capabilities fit a Linear workflow skill and data flows go to official Linear domains, but the trust boundary is problematic: the skill requires a preinstalled `lin` binary that available evidence suggests is a third-party/unofficial CLI, then asks users to supply a real Linear API key to that binary. There is no same-org official endorsement or surfaced checksum/signature evidence for the CLI, so credential forwarding to this external tool is disproportionate trust even though the skill text itself contains no overt malware or command-injection behavior.