LinkedIn Bulk Connect

• Analyzed: May 12, 2026, 3:58 AM
• Findings: 1
• Version: 1.1.0
• Hash: 78332042024a5ee11732708078d93ba55306cebbd4ae11526cd5cf535b474cf3
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle automates LinkedIn connection requests, which inherently involves high-risk browser automation and interaction with user-provided data. While the stated purpose is benign, the skill instructs the agent to read/write to a user-provided TSV file (SKILL.md) and construct search URLs using user-provided names and company data (references/browser-workflow.md). This reliance on unsanitized user input for file operations and URL construction presents a vulnerability for potential local file manipulation or search query injection if the agent does not robustly sanitize inputs. The extensive use of browser automation commands also carries inherent risks, even with the included anti-detection measures.