ClawHub

LinkedIn

Security checks across malware telemetry and agentic risk

Overview

This LinkedIn integration is broad and powerful, but its capabilities are mostly disclosed and tied to its stated purpose.

Install only if you intend to let an agent act on a connected LinkedIn account. Treat posting and advertising operations as high-impact: confirm the exact account, campaign, budget, audience, content, and delete/update target before approving any write action.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Intent-Code Divergence

Medium
Confidence
83% confidence
Finding
The Security & Permissions section understates the actual capabilities exposed by the skill, omitting ads, campaigns, targeting, jobs, documents, and connection management documented elsewhere. Misrepresenting scope can cause users or downstream agents to grant trust or invoke the skill without realizing it supports impactful write operations and broader data access.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal