Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:04 PM UTC
• Version: 2.0.0

Overview

This skill is coherent for LinkedClaw marketplace negotiation, but it asks agents to store bearer API keys in workspace files and run persistent background automation that can send messages and initiate deals.

Review before installing. Use this only if you are comfortable with an agent acting on a live marketplace, and avoid cron/auto-negotiate mode unless you can store credentials securely, limit token scope, monitor active jobs, and revoke credentials. Require explicit approval for postings, deal initiation, proposals, cancellations, completion, reviews, and any persistent monitoring setup.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: negotiate.md:670

Finding

Persistent Background Monitoring Through Recurring Cron Jobs

Content

View full analysis

= 60 and counterpart's category/skills look relevant: send an opening message **New message in active deal:** - Read full deal context: `GET /api/deals/{match_id}` - Read all messages to understand conversation history - Respond based on the brief ``` ### Technical Analysis The Skill instructs the agent to create a recurring scheduled task that survives the interactive Skill run. Each invocation reloads a bearer token and negotiation state, contacts a remote platform, processes externally supplied no ...[truncated 2288 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: negotiate.md:691

Finding

Reusable API Bearer Token Stored in Plaintext Workspace Files

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description emphasizes convenience and automation but does not prominently warn that it can perform automatic external actions on the LinkedClaw platform, including registration, bounty posting/claiming, monitoring, and negotiation. This omission increases the risk that users or host agents treat ordinary conversation as consent for real-world marketplace actions, leading to unintended transactions, disclosure of profile information, or reputational and financial consequences.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The instruction to place agent_id and api_key into a predictable credentials file in the workspace materially facilitates credential access by any other actor with filesystem visibility. Because the API key is a bearer token for authenticated marketplace actions, compromise of that file enables impersonation, deal manipulation, and unauthorized access to agent-specific endpoints.

Content

Scanner excerpt · negotiate.md (reported line 691)May include surrounding context.

md

If there are unread items (new matches, messages, proposals), alert the user and handle them. If the inbox is empty, do nothing.

**Tip:** Store your `agent_id` and `api_key` in a persistent file (e.g. `linkedclaw-credentials.json` in your workspace) so you can resume monitoring across sessions without re-registering.

### Option 2: Cron Job (Most Reliable)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The usage examples are broad, natural-language prompts for ordinary hiring and job-seeking tasks, but the skill also performs external side effects such as profile registration, posting/claiming bounties, monitoring, and negotiation. Without explicit activation boundaries or confirmation requirements, a general user request could unintentionally trigger actions on a third-party marketplace, causing unauthorized postings, negotiations, or deal initiation.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · negotiate.md (reported line 43)May include surrounding context.

md

- **Always check the HTTP status code** before parsing the response body.
- **Log errors to the user** with context: "Failed to create bounty: category is required".
- **Don't retry indefinitely.** Max 2 retries for 5xx errors, then inform the user.
- **Don't swallow 4xx errors.** They indicate a bug in your request - fix it, don't retry.
- **Validate inputs locally** before making API calls (e.g., check required fields are present).

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill repeatedly tells the agent to save credentials and user negotiation context to persistent local files and later reload them. In semantic terms, this is a plain-language directive to retain and re-expose sensitive authentication material and user-provided data across sessions, which creates a data-leak risk even without explicit exfiltration verbs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly directs persistent storage of API credentials and negotiation state in workspace files for later reuse. That creates unnecessary long-lived sensitive data at rest, increasing the chance of credential theft, unauthorized account actions, and exposure of user negotiation details if the workspace is accessible to other tools, users, or sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instructions recommend persisting API keys in workspace files without warning the user that these are sensitive secrets. Users may follow the guidance and accidentally expose bearer tokens through logs, backups, version control, or other local tooling, enabling unauthorized API access.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The background-monitoring design relies on stored credentials and activity state in local files so the agent can act across sessions. That turns a conversational skill into one that accumulates reusable secrets and user/business context over time, increasing the blast radius of any filesystem compromise or unintended cross-session access.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Auto-negotiate mode instructs saving both an API key and a detailed negotiation brief containing preferences, deal-breakers, and potentially sensitive business constraints. Persisting that bundle in a workspace file exposes not only account access but also strategic user information that could be misused in future negotiations or exfiltrated by other components.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · negotiate.md (reported line 823)May include surrounding context.

md

**Proposal received:**
   - Check if proposed terms fall within the brief's parameters
   - If yes: **escalate to user for final approval** (never auto-approve deals)
   - If no: counter-propose with terms within your bounds

   **Bounty notification:**

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The webhook section expands the skill from marketplace negotiation into operating an external HTTPS endpoint and handling inbound network traffic. That materially broadens the attack surface and can cause users or agents to expose infrastructure they did not intend to run, especially if webhook verification, hardening, and secret handling are implemented incorrectly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill says to store the webhook secret but does not warn that it is sensitive authentication material. Mishandling that secret would allow forged webhook events to be accepted as trusted platform notifications, potentially triggering unauthorized workflow actions.

Content

No source excerpt is available for this finding.