LinkedIn Autopilot

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:25 PM UTC
• Version: 1.1.0

Overview

This skill is a disclosed LinkedIn automation tool, but it asks for raw LinkedIn credentials and enables broad automated posting, messaging, engagement, and connection activity with weak safeguards.

Review before installing. Use only with an account you are willing to expose to automation risk, avoid storing your LinkedIn password in plaintext if possible, lock down any secrets/config files, keep dry-run enabled until you have reviewed recipients and message/post content, and understand that LinkedIn may restrict accounts for automation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup.sh:12

Finding

Plaintext LinkedIn Credentials and Insufficient File Permission Hardening

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:23-29
• scripts/setup.sh:12-18
• scripts/setup.sh:24-44
• scripts/setup.sh:53-68

Vulnerability Type: Plaintext sensitive-data storage and insecure filesystem permissions
Risk Level: Medium

Vulnerable Code

SKILL.md:23-29 instructs users to store reusable LinkedIn credentials in a plaintext environment file:

bash

3. Store LinkedIn credentials in `~/.clawdbot/secrets.env`:
   ```bash
   LINKEDIN_EMAIL=[e-mail]
   LINKEDIN_PASSWORD=your-password
   ```
4. Test with: `scripts/engage.sh --dry-run`

scripts/setup.sh:12-18 creates the configuration directory and configuration file without explicitly enforcing restrictive permissions:

bash

# Create config directory
mkdir -p "$CONFIG_DIR"
echo "✓ Created $CONFIG_DIR"

# Copy example config if none exists
if [ ! -f "$CONFIG_DIR/config.json" ]; then
  cp "$SKILL_DIR/config.example.json" "$CONFIG_DIR/config.json"

scripts/setup.sh:24-44 creates state files using ordinary shell redirection, leaving their permissions dependent on the invoking process's umask:

bash

# Initialize data files
for file in posts-queue.json engagement-history.json dm-sequences.json connections.json analytics.json activity-log.json; do
  if [ ! -f "$CONFIG_DIR/$file" ]; then
    case "$file" in
      posts-queue.json)
        echo '{"posts":[]}' > "$CONFIG_DIR/$file"
        ;;
      engagement-history.json)
        echo '{"engagements":{}}' > "$CONFIG_DIR/$file"
        ;;
      dm-sequences.json)
        echo '{"sequences":{}}' > "$CONFIG_DIR/$file"
        ;;
      connections.json)
        echo '{"connections":{}}' > "$CONFIG_DIR/$file"
        ;;
      analytics.json)
        echo '{"history":[]}' > "$CONFIG_DIR/$file"
        ;;
      activity-log.json)
        echo '[]' > "$CONFIG_DIR/$file"
        ;;

`scripts/setup.sh: ...[truncated 3365 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an operating-system keychain, credential manager, or supported secret-management service instead of storing a reusable LinkedIn password in a plaintext file.
2. Where file-based secrets are unavoidable, set a restrictive process mask before creating any files:

   bash

   umask 077
   

3. Create and repair directory permissions explicitly:

   bash

   install -d -m 700 "$CONFIG_DIR"
   

4. Create configuration and state files with mode 0600, using install, securely created temporary files, and atomic replacement where updates are required.
5. Validate that ~/.clawdbot/secrets.env is owned by the current user, is a regular file rather than a symbolic link, and has no group or other permissions. Refuse to continue until unsafe permissions are corrected.
6. Apply equivalent ownership, regular-file, and symbolic-link checks to the configuration directory and all state files before reading or writing them.
7. Avoid recording passwords, session tokens, complete private messages, or other unnecessary sensitive content in activity logs.
8. Update SKILL.md to document the required permissions and recommend session-based authentication or a secret manager as the primary authentication method.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a broad LinkedIn autopilot covering posting, engagement, DMs, connection workflows, profile visits, follow-ups, and throttling. The supplied code chunk only corresponds to a skeletal posting script, and even that functionality is mostly placeholder logging with commented examples rather than real execution. There is no evidence in this chunk of the other major declared capabilities, nor of broader orchestration or engagement logic. This is therefore a material description-to-behavior mismatch, with the actual code implementing only a narrow and incomplete subset of the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a full LinkedIn automation agent that actively schedules posts, engages with accounts, sends DMs, handles connection workflows, and runs campaigns. The supplied code chunk does none of those things. It is a standalone reporting script that prints a weekly analytics summary using placeholder values. Although comments reference possible data files and sending a message to a channel, the implemented behavior is limited to formatting and outputting a report. This is a material purpose mismatch: the code is for analytics/reporting, while the description claims broad autonomous LinkedIn activity execution.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill instructs users to store raw LinkedIn email and password for browser automation, creating direct credential-handling risk. In a skill designed for continuous automated use, those credentials could be exposed through logs, local compromise, misconfigured secret storage, or unintended reuse, giving full access to the user's LinkedIn account.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

1. Run scripts/setup.sh to initialize config and data directories
2. Edit ~/.config/linkedin-autopilot/config.json with targets, sequences, and posting schedule
3. Store LinkedIn credentials in ~/.clawdbot/secrets.env:

   bash

   LINKEDIN_EMAIL=[e-mail]
   LINKEDIN_PASSWORD=your-password
   

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · scripts/dm-sequence.sh (reported line 70)May include surrounding context.

sh

# 5. Send messages via browser automation
if [ "$DRY_RUN" = "true" ]; then
  log "DRY RUN: Would send message to Contact 1: 'Hey! Thanks for connecting...'"
  log "DRY RUN: Would send message to Contact 2: 'Following up on our chat...'"
else
  # Browser automation to send DMs

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · scripts/dm-sequence.sh (reported line 71)May include surrounding context.

sh

# 5. Send messages via browser automation
if [ "$DRY_RUN" = "true" ]; then
  log "DRY RUN: Would send message to Contact 1: 'Hey! Thanks for connecting...'"
  log "DRY RUN: Would send message to Contact 2: 'Following up on our chat...'"
else
  # Browser automation to send DMs

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 54)May include surrounding context.

sh

done

# Check for credentials
SECRETS_FILE="$HOME/.clawdbot/secrets.env"
if [ -f "$SECRETS_FILE" ]; then
  if grep -q "LINKEDIN_EMAIL" "$SECRETS_FILE" 2>/dev/null && grep -q "LINKEDIN_PASSWORD" "$SECRETS_FILE" 2>/dev/null; then
    echo "✓ LINKEDIN_EMAIL and LINKEDIN_PASSWORD found in secrets.env"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 57)May include surrounding context.

sh

done

# Check for credentials
SECRETS_FILE="$HOME/.clawdbot/secrets.env"
if [ -f "$SECRETS_FILE" ]; then
  if grep -q "LINKEDIN_EMAIL" "$SECRETS_FILE" 2>/dev/null && grep -q "LINKEDIN_PASSWORD" "$SECRETS_FILE" 2>/dev/null; then
    echo "✓ LINKEDIN_EMAIL and LINKEDIN_PASSWORD found in secrets.env"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The script instructs users to store their LinkedIn email and password in a plaintext file under the home directory. While it does not itself exfiltrate credentials, normalizing plaintext storage of account passwords increases the risk of credential compromise from local malware, overly broad file permissions, backups, or other tools reading that file.

Content

Scanner excerpt · scripts/setup.sh (reported line 59)May include surrounding context.

sh

if grep -q "LINKEDIN_EMAIL" "$SECRETS_FILE" 2>/dev/null && grep -q "LINKEDIN_PASSWORD" "$SECRETS_FILE" 2>/dev/null; then
    echo "✓ LINKEDIN_EMAIL and LINKEDIN_PASSWORD found in secrets.env"
  else
    echo "⚠ LinkedIn credentials not found in secrets.env"
    echo "  Add:"
    echo "  LINKEDIN_EMAIL=[e-mail]"
    echo "  LINKEDIN_PASSWORD=your-password"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill requests browser use and describes automated networked actions against LinkedIn, but it does not declare an explicit tool scope such as allowed tools or permissions. That creates unnecessary ambiguity about what external actions the skill may perform and weakens reviewability and policy enforcement for a credentialed automation workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The setup instructions ask users to provide LinkedIn credentials and enable extensive automated account actions without placing prominent risk warnings near that step. In context, this is more dangerous because the skill targets a real user account for high-volume automated behavior that can expose private data, trigger account restrictions, or cause unintended outreach.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document presents a human-in-the-loop compliance posture while earlier sections describe fully automated posting, engagement, connection requests, and DM sending. This contradiction can mislead users and reviewers about the real operational risk, causing them to enable credentialed automation under false assumptions about oversight and safety.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script is designed to automate outbound LinkedIn direct messages and, in normal mode, proceeds without any explicit per-run confirmation, approval gate, or recipient review before sending. In the context of a growth-automation skill, this increases the risk of unintended messaging, spam behavior, account-policy violations, and reputational harm if configuration or targeting is wrong.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

These lines indicate the automation may use login credentials, including filling the login form with "$LINKEDIN_EMAIL", but there is no accompanying warning about accessing or using sensitive credentials. For a code file, credential handling should include some form of user disclosure unless it is clearly warned elsewhere in the file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.