📦 Linear Todos — 线性任务管理
v1.1.0命令行工具，通过 Linear API 用自然语言创建、排期与优先级管理待办事项。
0· 775·1 当前·1 累计
by 下载技能包
最后更新
2026/4/22
安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears to do what it says: it runs bundled Python code to manage Linear issues and only contacts api.linear.app. Before installing or running setup: 1) prefer setting LINEAR_API_KEY in your environment rather than running the interactive setup to avoid writing the API key to disk; 2) if you must run setup, be aware it will store the key in plaintext at ~/.config/linear-todos/config.json with 0o600 permissions; 3) the code may read a workspace USER.md (to infer timezone) — if that fil...详细分析 ▾
✓ 用途与能力
Name/description match the implementation: the package contains a Python CLI that calls Linear's GraphQL API. Required credential (LINEAR_API_KEY) and the declared config path (~/.config/linear-todos/config.json) are appropriate for the stated functionality.
ℹ 指令范围
Runtime instructions and code are mostly scoped to Linear API operations and local config. One scope extension: the config code can attempt to read an OpenClaw workspace USER.md (searching up to 5 parent directories) to infer a timezone; this is declared in SKILL.md but is additional local file access beyond the config file. Also the setup wizard temporarily sets LINEAR_API_KEY in-process to validate the key (documented).
✓ 安装机制
Install metadata uses 'uv' (an existing tool). The skill is source-execution (bundled Python) with no external downloads performed by the skill itself. pyproject lists normal Python deps (click, dateparser, requests). The README suggests installing 'uv' via its installer script, but that is a separate tool-install recommendation and not part of this skill's install spec.
ℹ 凭证需求
Only LINEAR_API_KEY is required (primary credential), which is proportional. Optional LINEAR_* env vars are reasonable. Minor caveat: the code checks additional environment variables (XDG_CONFIG_HOME for config dir, and a test toggle LINEAR_TODOS_NO_USERMD_FALLBACK) that are not listed in the requires.env table; the latter is a harmless testing toggle but is an undocumented env-var the code reads.
✓ 持久化与权限
always is false. The skill writes a plaintext JSON config only when the user runs the interactive 'setup' command; file permissions are set to user read/write (0o600). It does not auto-install cron jobs or modify other skills or system settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.1.02026/2/17
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install linear-todos
镜像加速npx clawhub@latest install linear-todos --registry https://cn.longxiaskill.com