add-linear — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited add-linear (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Adds Linear support via the Chat SDK bridge. The agent participates in issue comment threads. Every comment on a Linear issue triggers the agent — no @-mention needed.
Recommended: Create a Linear OAuth application so the agent posts as an app identity, not as you. This prevents the adapter from filtering your own comments as self-messages.
https://github.com/your-org/nanoclaw)http://localhostAlternative: Use a Personal API Key (LINEAR_API_KEY) for simpler setup. The agent will post as you, and your own comments will be filtered (other team members' comments still work).
NanoClaw doesn't ship channels in trunk. This skill copies the Linear adapter in from the channels branch and wires it into the channel registry. Linear OAuth apps post and read comments under an app identity that can't be @-mentioned, so when you wire the channel in /manage-channels, pick an engage mode that responds to plain comments rather than mention-only.
Skip to Credentials if all of these are already in place:
src/channels/linear.ts existssrc/channels/linear-registration.test.ts existssrc/channels/index.ts contains import './linear.js';@chat-adapter/linear is listed in package.json dependenciesOtherwise continue. Every step below is safe to re-run.
git fetch origin channelsgit show origin/channels:src/channels/linear.ts > src/channels/linear.ts
git show origin/channels:src/channels/linear-registration.test.ts > src/channels/linear-registration.test.tsAppend to src/channels/index.ts (skip if the line is already present):
import './linear.js';pnpm install @chat-adapter/[email protected]pnpm run build
pnpm exec vitest run src/channels/linear-registration.test.tsBoth must be clean before proceeding. linear-registration.test.ts is the one integration test: it imports the real channel barrel and asserts the registry contains linear. It goes red if the import './linear.js'; line is deleted or drifts, if the barrel fails to evaluate, or if @chat-adapter/linear isn't installed (the import throws) — so it also implicitly verifies the dependency from step 4. The adapter calls core's createChatSdkBridge(...); that typed core-API consumption is guarded by pnpm run build.
End-to-end message delivery against a real Linear workspace is verified manually once the service is running — see Wiring and Next Steps.
NanoClawhttps://your-domain/webhook/linear (the shared webhook server, default port 3000)Note: Linear webhook delivery may be delayed 1-5 minutes for new webhooks. This is normal.
Add to .env:
# OAuth app (recommended)
LINEAR_CLIENT_ID=your-client-id
LINEAR_CLIENT_SECRET=your-client-secret
# OR Personal API key (simpler, but agent posts as you)
# LINEAR_API_KEY=lin_api_...
LINEAR_WEBHOOK_SECRET=your-webhook-signing-secret
LINEAR_BOT_USERNAME=NanoClaw Bot
LINEAR_TEAM_KEY=ENGLINEAR_BOT_USERNAME: display name for the bot (used for self-message detection when using a Personal API Key)LINEAR_TEAM_KEY: the Linear team key (e.g. ENG, NAN). Find it in Linear under Settings > Teams. All issues in this team route to one messaging group.Sync to container: mkdir -p data/env && cp .env data/env/env
Ask the user: Is this a private or public Linear workspace?
unknown_sender_policy: 'public'. Only workspace members can comment.unknown_sender_policy: 'strict' and add trusted members (see GitHub skill for member registration example).Run /manage-channels to wire the Linear channel to an agent group, or insert manually:
-- Create messaging group (one per team)
INSERT INTO messaging_groups (id, channel_type, platform_id, instance, name, is_group, unknown_sender_policy, created_at)
VALUES ('mg-linear-eng', 'linear', 'linear:ENG', 'linear', 'Engineering', 1, 'public', datetime('now'));
-- Wire to agent group
INSERT INTO messaging_group_agents (id, messaging_group_id, agent_group_id, trigger_rules, response_scope, session_mode, priority, created_at)
VALUES ('mga-linear-eng', 'mg-linear-eng', '<your-agent-group-id>', '', 'all', 'per-thread', 10, datetime('now'));The platform_id must be linear:<TEAM_KEY> matching the LINEAR_TEAM_KEY env var. Use per-thread session mode so each issue comment thread gets its own agent session.
If you're in the middle of /setup, return to the setup flow now.
Otherwise, restart the service to pick up the new channel.
Run from your NanoClaw project root:
source setup/lib/install-slug.sh
launchctl kickstart -k gui/$(id -u)/$(launchd_label) # macOS
systemctl --user restart $(systemd_unit) # Linuxlinearlinear:<TEAM_KEY> (e.g. linear:ENG). Find your team key in Linear under Settings > Teams. Each issue becomes its own thread automatically.per-thread session mode. Each issue comment thread gets its own isolated agent session.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.