Agent skill · security · jeremylongshore
linear-security-basics
Harden Linear credentials, OAuth, team access, webhook verification, logging, and rotation. Use when threat-modeling an integration or correcting a security gap. Trigger with "secure Linear integration", "review Linear OAuth security", or "verify Linear webhooks".
Why this skill is useful
Provides specific OAuth 2.0 implementation patterns and secure API key management practices tailored for Linear integrations.
What it needs
Requires linear account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Linear Integration Security Baseline Overview Apply least privilege and fail-closed verification across every credential, workspace boundary, inbound event, and diagnostic path. Prerequisites The target repository, Linear workspace, environment, and accountable owner Current security, privacy, compliance, capacity, and change-control requirements An approved Linear credential only when a bounded live verification is necessary Tool Discipline Use Read, Glob, and Grep to inspect code, configuration, and evidence. Use WebFetch only for current first-party Linear documentation and package metadata. Use Write or Edit only for requested implementation with known target files. Never write credentials, customer content, unrestricted environment output, or unredacted GraphQL variables. Current Contract Authorization-code OAuth supports PKCE; applications must use exact registered redirect URLs and validate authorization state. All OAuth apps moved to the refresh-token system on 2026-04-01; access and refresh tokens require secure server-side storage and revocation handling. Webhook authenticity is HMAC-SHA256 over the exact raw body; compare safely and use timestamp/delivery ID for replay controls. Client-secret rotation and webhook-signing-secret rotation are separate operations with different impacts. Authentication Use a personal API key only for owner-controlled scripts, OAuth with PKCE for user-delegated applications, or an enabled client-credentials grant for approved automation. Personal keys use Authorization: <APIKEY>; OAuth tokens use Authorization: Bearer <ACCESSTOKEN>. Store credentials server-side in an approved secret manager. Treat app approval, team access, scope changes, credential creation, rotation, revocation, and production access as owner-approved actions. Instructions 1. Inventory tokens, client and signing secrets, redirect URLs, scopes, team access, caches, logs, exports, and third-party processors. 2. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/linear-security-basics