Linear

The skill is a CLI wrapper around Linear's GraphQL API and legitimately needs LINEAR_API_KEY. However, the included bash script requires curl, jq, and cksum at runtime (and the SKILL.md mentions curl/jq), while the registry metadata lists no required binaries — that's a metadata mismatch that could confuse installers.

Runtime instructions and the script confine activity to the Linear GraphQL endpoint (https://api.linear.app/graphql) and local caching. The script does not attempt to read arbitrary user files, send data to unexpected third-party endpoints, or perform obfuscated actions. It does create a cache file in /tmp by default (derived from a checksum of your API key).

No install spec (instruction-only plus an included bash script). Nothing is downloaded from external URLs and no archives are extracted. Risk from installation is low — but the script assumes curl and jq are available on the system.

The only required environment variable declared in the registry is LINEAR_API_KEY, which is appropriate. The SKILL.md and script also reference optional vars (LINEAR_DEFAULT_TEAM and LINEAR_TEAMS_CACHE) that are not listed in the registry metadata; this is not a security problem but is a documentation gap. The script derives a cache filename from the API key (cksum) and writes cached team data to /tmp by default, which could leave a recoverable artifact tied to your key.

The skill is not always: true and does not attempt to modify other skills or system-wide settings. It writes only its own cache file and has no elevated privileges.