ClawHub
Back to skill

Security audit

LinkedIn CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent LinkedIn CLI, but it asks users to extract active LinkedIn session cookies and passes them to an unpinned third-party package while also displaying private messages.

Review this carefully before installing. Only use it in an isolated environment, understand that li_at and JSESSIONID can grant access to your LinkedIn account, avoid sharing terminal logs from message/feed commands, and prefer a pinned, reviewed dependency set if you proceed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:34
Finding

Unpinned Security-Sensitive Third-Party Dependency

Content
View full analysis
Remediation
View remediation
``` 2. Maintain a lock file that also pins transitive dependencies. 3. Require package hashes, for example through a hash-locked requirements file and: ```bash pip install --require-hashes -r requirements.txt ``` 4. Review dependency changes before updating the lock file, with particular attention to installation hooks, networking, and cookie handling. 5. Install and execute the CLI in an isolated virtual environment under a non-privileged user. 6. Use automated dependency vulnerability and provenance checks in the release process. 7. Document the expected package index and disable unintended extra indexes to reduce dependency-confusion exposure. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/lk.py:66
Finding

Terminal Control-Sequence Injection Through LinkedIn Content

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
91% confidence
Finding

The cookie-extraction instructions match credential-harvesting behavior because they direct users to retrieve browser session tokens that can be reused for authenticated access. In context, this is not overt malware, but it is still dangerous because it normalizes exfiltration-style handling of highly sensitive credentials for automation against a personal account.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
/github.com/clawdbot/linkedin-cli
metadata: {"clawdbot":{"emoji":"💼","requires":{"bins":["python3"],"env":["LINKEDIN_LI_AT","LINKEDIN_JSESSIONID"]}}}
---

# LinkedIn CLI (lk)

A witty, punchy LinkedIn CLI inspired by the `bird` CLI. It uses session cookies for authentication, allowing for automated profile scouting, feed summaries, and message checks without a browser.

## Setup

1.  **Extract Cookies**: Open LinkedIn in Chrome/Firefox.
2.  Go to **DevTools (F12)** -> **Application** -> **Cookies** -> `www.linkedin.com`.
3.  Copy the values for `li_at` and `JSESSIONID`.
4.  Set them in your environment:
    ```bash
    export LINKEDIN_LI_AT="your_li_at_value"
    export LINKEDIN_JSESSIONID="your_jsessionid_value"
    ```

## Usage

- `lk whoami`: Display your current profile details.
- `lk search "query"`: Search for people by keywords.
- `lk profile <public_id>`: Get a detailed summary of a specific profile.
- `lk feed -n 10`: Summarize the top N posts from your timeline.
- `lk mes

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill declares environment and network-dependent behavior but does not declare any explicit tool scope or permissions boundary. This weakens reviewability and increases the chance that a user or host agent will grant broader access than necessary, especially since the skill handles sensitive session cookies for a third-party account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs users to manually extract active LinkedIn session cookies and store them as environment variables without any warning that these are equivalent to account bearer credentials. Anyone who obtains those values can impersonate the user, access account data, and potentially trigger account abuse or privacy violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code accesses sensitive authentication material via LINKEDIN_LI_AT and LINKEDIN_JSESSIONID and immediately uses it to authenticate API requests. While the script errors if variables are absent, it does not disclose to users that it consumes account session cookies or explain the sensitivity of those credentials in comments, docstrings, or user-facing help.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This function reads private conversation data and prints message previews to stdout, which can expose sensitive personal content on screen or in terminal logs. There is no confirmation prompt, cautionary help text, or explanatory comment warning users that private messages will be accessed and displayed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.