Security audit

LinkedIn Bulk Connect

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it automates bulk LinkedIn outreach from a real account and includes anti-detection guidance that users should review carefully.

Install only if you are comfortable with an agent operating a logged-in LinkedIn session, sending real connection requests, and modifying your tracking file. Review each recipient list first, keep batches small, avoid accounts already warned for automation, and prefer requiring confirmation before any request is sent.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:72
Finding: Unvalidated File-Controlled Browser Navigation Target
Content: View full analysis
targetId= targetUrl= ``` ### Technical Analysis The workflow treats a profile URL read from a user-supplied spreadsheet as a trusted LinkedIn URL. It does not require the agent to parse, canonicalize, or validate the URL before passing it to the browser navigation tool. In particular, the instructions do not enforce: - The `https` scheme. - An exact permitted hostname such as `www.linkedin.com`. - An expected LinkedIn profile path such as `/in/`. - Rejection of embedded credentials, nonstandard ports, deceptive subdomains, or encoded hostnames. - Validation of the final destination after an HTTP redirect. - Final-domain validation after clicking a profile link returned by Google. Because the workflow reuses an existing authenticated browser tab, a malicious or compromised data file can cause that tab to navigate to attacker-controlled content. Browser same-origin controls ordinarily prevent a foreign site from directly reading LinkedIn cookies, so this issue does not by itself establish direct cookie theft. Nevertheless, the hostile page can present a convincing login prompt, solicit sensitive information, exploit browser vulnerabilities, or manipulate subsequent user actions. ### Attack Path 1. An attacker supplies or modifies the CSV/TSV used by the Sk ...[truncated 1288 chars]
Remediation: View remediation
`. 4. Reject URLs containing embedded credentials, unexpected ports, deceptive subdomains, malformed encodings, or unsupported schemes. 5. Do not rely on substring checks such as `"linkedin.com" in url`; compare the parsed hostname exactly. 6. After every navigation or search-result click, inspect the final URL and stop if it is outside the approved LinkedIn origin. 7. Treat redirects to non-allowlisted origins as failures rather than continuing the workflow. 8. For Google fallback results, extract and validate the destination URL before clicking it. 9. Warn the user and mark the row as invalid when an untrusted URL is encountered. A suitable policy is: ```text scheme == "https" hostname == "www.linkedin.com" path starts with "/in/" no embedded username/password no unexpected port final redirected URL passes the same checks ``` ]]>

other

Warning

Location: SKILL.md:125
Finding: Explicit Evasion of LinkedIn Automation Detection
Content: View full analysis
⚠️ LinkedIn flags accounts that jump directly between profile URLs. Always visit the feed between profiles — no exceptions. - **Navigate to `/feed/` before every single profile**, without exception. See `references/browser-workflow.md` for the exact call. This is the primary anti-detection measure. - Add a short natural pause (2–4 seconds) after loading the feed before navigating to the next profile. - If >3 consecutive clean URLs return 404, pause for 10 seconds on the feed before continuing (then fall back to Google/LinkedIn search). - Do not open new browser tabs — the relay breaks; reuse the same attached tab for every action. - Aim for no more than 20–25 connection requests per session. Stop and tell the user if you're approaching this limit. ``` Related setup guidance also recommends the relay for accounts already subject to enforcement: ```markdown **Option A — Chrome Browser Relay (recommended for accounts flagged for automation)** ``` ### Technical Analysis The Skill does not merely automate an ordinary user workflow; it explicitly prescribes behavior intended to reduce the likelihood that LinkedIn detects the automation. The feed-navigation pattern, randomized-looking pauses, session limits, and special handling for accounts already flagged for automation are framed as anti-detection controls. These instructions can enable sustained bulk connection activity while attempting to circumvent platform abuse safeguards. The behavior is outside the listed T01–T09 security categories, but it presents platform-integrity, account-safety, and abuse risks. The connection limit partially reduces volume, but it does not resolve the underlying issue because the ...[truncated 1434 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill description is broad enough to activate on routine requests to bulk-connect on LinkedIn, but it does not clearly constrain use by consent, account policy, or acceptable automation boundaries. That creates a real risk of the agent being invoked for platform-policy-violating outreach or spam-like automation without an explicit safety gate.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill includes direct instructions and sample code to modify the user's CSV/TSV tracking file by adding or overwriting a Connection Status column, but it does not require an explicit warning or confirmation before changing user data. This is dangerous because it can cause unintended file mutation, data loss, or corruption of an existing workflow if the column already has meaning or the write operation fails mid-update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The workflow explicitly instructs the agent to click LinkedIn's 'Send without a note' control and mark the request as sent, but it does not require a just-in-time user confirmation before performing that external side effect. Because this skill performs bulk outbound actions from the user's real LinkedIn account, accidental execution, mis-targeting, or silent mass requests could create reputational harm, spam, or account enforcement issues.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The skill instructs creation and maintenance of a linkedin_progress.json sidecar file but does not clearly disclose this as a persistent filesystem write to the user. While lower impact than in-place spreadsheet editing, it still creates undeclared local artifacts that may expose outreach activity, confuse users, or conflict with existing files.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.