Security audit

LinkedIn Follow-up

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent LinkedIn follow-up assistant, but it uses authenticated LinkedIn and Google Sheets access with anti-detection guidance, full thread scraping, persistent logging, and unsafe command templates that warrant Review before installation.

Install only if you are comfortable giving the agent access to your LinkedIn session and the specified Google Sheet. Require manual confirmation before every send and every Sheet write, avoid local fallback logging unless you intentionally want a local record, and treat all LinkedIn replies and Sheet cells as untrusted content. The anti-detection instructions should be removed or replaced with compliant, user-directed workflows before routine use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:119
Finding: Untrusted LinkedIn Conversation Content Can Hijack Agent Instructions
Content: View full analysis
{ const groups = el.querySelectorAll('.msg-s-event-listitem'); groups.forEach(g => { const nameEl = g.closest('.msg-s-message-group')?.querySelector('.msg-s-message-group__profile-link'); const bodyEl = g.querySelector('.msg-s-event-listitem__body'); const timeEl = g.closest('.msg-s-message-group')?.querySelector('.msg-s-message-group__timestamp'); if (bodyEl?.textContent?.trim()) { messages.push({ sender: nameEl?.textContent?.trim() || 'unknown', time: timeEl?.textContent?.trim() || '', text: bodyEl.textContent.trim() }); } }); }); return JSON.stringify(messages); ``` ```markdown #### Step 4 — Analyse the conversation With the full thread loaded + their profile data, determine: - **What did they say last?** — Identify the most recent message from them. - **What's the intent?** — Interested / wants more info / asked a question / cold / objection / not interested. - **What's the right next message?** — See [Response Playbook](#response-playbook) below. - **Tone** — Mirror their tone (casual vs formal, brief vs detailed). ``` ### Technical Analysis The skill extracts arbitrary LinkedIn message bodies and places them directly into the agent's reasoning context. LinkedIn participants control this content, but the instructions do not explicitly identify it as untrusted data or prohibit the agent from treating embedded commands as operational instructions. This creates an indirect prompt-injection boundary. For example, a malicious participant could send a message containing instructions to disregard ...[truncated 2180 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:164
Finding: Unsafe Interpolation of Dynamic Content into JavaScript and Shell Command Templates
Content: View full analysis
'); } ``` Then find and click Send. #### Step 7 — Update the sheet After sending: ```bash gog sheets update "Sheet1!J:P" \ --values-json '[["","","","","",""]]' \ --input USER_ENTERED ``` ``` ### Technical Analysis The documented browser workflow inserts a dynamic message directly into a single-quoted JavaScript string. A message containing a single quote, backslash, line terminator, or crafted JavaScript fragment can terminate or alter the intended string if an implementation performs literal placeholder substitution. For example, content shaped like the following could escape the string context: ```text '); /* attacker-controlled JavaScript */ // ``` The Sheets workflow has a related issue. Dynamic values—including externally controlled reply previews and conversation logs—are embedded into JSON inside a single-quoted shell argument. Ordinary apostrophes can terminate the shell string, while quotes, backslashes, and newlines can invalidate the JSON. If values are substituted literally into a shell command, shell metacharacters following a terminated quote may be interpreted as commands. Conversation logs are particularly exposed because they preserve arbitrary LinkedIn message content. Therefore, an attacker can introduce malicious quoting characters before t ...[truncated 2300 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.

Download client_secret_<id>.json

Run:
bash
gog auth credentials set /path/to/client_secret.json gog auth add your@gmail.com --services sheets

A browser window will open — log in and grant access

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly instructs the agent to visit LinkedIn feed first and add waits to reduce detection before automating profile navigation and messaging. That is evasive guidance unrelated to legitimate CRM data management and encourages covert automation against a third-party platform's anti-abuse controls.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrase 'Check my outreach' is broad enough to match ordinary language and could invoke a workflow that reads CRM data, reviews message threads, and prepares outreach actions without sufficiently explicit user intent. In a skill that can access conversation history and send follow-ups, ambiguous activation raises the risk of unintended data access or outbound actions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The dedicated 'Anti-Detection Rules' section is a strong signal that the skill is designed to disguise automated behavior rather than simply assist with follow-up workflows. Embedding operational evasion guidance increases the likelihood of policy violations, account restrictions, and misuse of browser automation for unsolicited outreach.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill directs the agent to log outreach data to a local JSON file when Google Sheets is unavailable, but it gives no warning that conversation content and lead data may be stored on disk outside the primary system of record. This can create silent data retention, privacy, and access-control issues, especially if messages contain personal or sensitive business information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow explicitly instructs the agent to scrape full LinkedIn conversation contents and expose them into agent context, which can include sensitive personal, professional, or confidential information. In this skill context, reading and processing message threads may be functionally necessary, but collecting the entire thread without data-minimization, consent checks, or privacy warnings increases the risk of unnecessary disclosure and retention of third-party communications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The workflow not only sends LinkedIn messages but also writes conversation-derived data into a persistent Google Sheet, creating both third-party side effects and long-term storage of potentially sensitive communications. Because the instructions do not require an explicit confirmation step, authorization check, or warning before modifying external accounts and records, an operator or agent could mistakenly send messages or persist private data at scale.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.