LinkedIn

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:16 AM UTC
• Version: 1.0.0

Overview

This LinkedIn automation skill is mostly clear about what it does, but it under-explains the risk of copying a reusable LinkedIn session cookie outside the browser.

Review carefully before installing. Prefer the Chrome extension relay or isolated browser profile, and avoid the session-cookie method unless you have a secure secret-storage workflow and understand that the li_at cookie can grant access to your LinkedIn session if exposed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:58

Finding

Unsafe Extraction and Handling of LinkedIn Session Cookie

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 58-64
Vulnerability Type: Exposure and insecure handling of reusable session credentials
Risk Level: Medium

Vulnerable Code:

markdown

## Session Cookie Method (Advanced)
If browser relay isn't available, extract the `li_at` cookie from browser:
1. Open LinkedIn in browser, log in
2. DevTools → Application → Cookies → linkedin.com
3. Copy `li_at` value
4. Store securely for API requests

Technical Analysis

The skill instructs users to manually extract and copy LinkedIn's li_at session cookie. This cookie is a reusable authentication credential capable of representing an authenticated LinkedIn session. Moving it outside the browser's managed cookie storage expands its exposure to the clipboard, terminal history, agent context, logs, request traces, plaintext files, and other processes.

The phrase “Store securely” does not define an enforceable security mechanism. The skill provides no requirement for OS-backed secret storage, access controls, encryption, credential lifetime limits, log redaction, secure deletion, or session revocation. It also does not constrain the destinations to which the credential may be sent when making API requests.

No evidence shows that the skill automatically steals or exfiltrates the cookie. The vulnerability is the unsafe credential-handling procedure itself.

Attack Path

1. A user follows the skill's instructions and extracts the li_at cookie through browser developer tools.
2. The credential is copied to the system clipboard or placed in unspecified storage for subsequent API requests.
3. The cookie is unintentionally retained in clipboard history, logs, agent conversation records, command history, a plaintext file, or another insufficiently protected location.
4. A malicious local process, unauthorized user, compromised tool, or party with access to those records obtains the cookie.
5. The att ...[truncated 760 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the session-cookie extraction method and require the authenticated browser relay or isolated browser profile, allowing the browser to retain control of protected cookies.
2. If direct authenticated requests are essential, use an officially supported OAuth or LinkedIn API authorization flow instead of extracting browser session cookies.
3. Never place session cookies in prompts, command-line arguments, logs, source files, configuration files, or plaintext temporary files.
4. Store unavoidable credentials in an OS-backed credential manager or dedicated secret-management system with encryption at rest and access restricted to the minimum required process.
5. Implement automatic redaction for cookies and authorization headers in browser traces, HTTP diagnostics, errors, and audit logs.
6. Restrict requests to an explicit allowlist of official LinkedIn HTTPS endpoints and prevent credentials from being attached to redirects or third-party origins.
7. Minimize credential retention, securely delete temporary copies, clear clipboard contents where practical, and document how users can terminate active LinkedIn sessions if exposure is suspected.
8. Add explicit warnings that li_at is a sensitive authentication credential and must never be disclosed to an agent, another user, or an untrusted tool.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

## Safety Rules
- **Never send messages without explicit user approval**
- **Never accept/send connection requests without confirmation**
- **Avoid rapid automated actions** - LinkedIn is aggressive about detecting automation
- Rate limit: ~30 actions per hour max recommended

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs users to extract the li_at session cookie, which is effectively a bearer credential for the LinkedIn account. Without prominent warnings about secrecy, scope, storage, and misuse, the skill normalizes handling highly sensitive session material in an unsafe way; anyone who obtains that cookie may be able to impersonate the user until the session is revoked or expires.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.