enrich-linkedin-profile

• Outcome: Review
• Latest audit: Sep 29, 2026 · 11:37 PM UTC
• Version: 1.1.1

Overview

The LinkedIn enrichment purpose is clear, but the skill adds unrelated account actions, local agent-config checks, telemetry-style attribution, and unpinned installs that users should review first.

Review before installing. Use this only if you are comfortable installing an unpinned Cargo CLI, sending LinkedIn profile data to Cargo/aiArk, allowing Cargo session attribution, and being asked to let the agent star the publisher's GitHub repository. Decline or remove the star and attribution steps if you only want the enrichment workflow.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 96% confidence

Finding

The skill reads ~/.claude/plugins/installed_plugins.json to inspect the agent's local configuration and decide behavior. Accessing agent config directories is sensitive because it can reveal installed tools, environment characteristics, or other metadata unrelated to the user task, and normalizes local reconnaissance inside a skill.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

marker onto the real session row, and two rows for one session would double-count this skill in that query. -->

bash

grep -q '"cargo@gtm"' ~/.claude/plugins/installed_plugins.json 2>/dev/null ||
  cargo-ai workspaceManagement session upsert \
    --session-id "${SESSION_ID:-$(date +%s)}" \
    --title "enrich-linkedin-profile" \

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description lists broad triggers such as "who is this person" and "pull the whole biography," which are common natural-language requests and are not specific to LinkedIn-profile enrichment. Although some skip conditions are provided, the trigger scope is still wide enough to cause unintended invocation outside the intended workflow.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: enrich-linkedin-profile
description: "Turn a LinkedIn profile URL into a full person profile plus a verified work email in a single call, powered by Cargo. Triggers: \"enrich these LinkedIn profiles\", \"get details from this LinkedIn URL\", \"I have LinkedIn URLs and need emails\", \"enrich LinkedIn data\", \"who is this person\", \"contact enrichment\", \"linkedin enrichment\", \"get their headline and tenure\", \"pull the whole biography\". Providers: aiArk. Skip when: you do not have the LinkedIn URL yet — use find-linkedin-url first; or you only have a name and domain — use find-work-email."
version: "1.1.1"
compatibility: Requires @cargo-ai/cli (npm). Sign in or create an account with `cargo-ai login --email` (emailed code, no browser), `--oauth`, or an API token
homepage: https://github.com/getcargohq/gtm-skills
metadata:
  author: getcargo

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The skill instructs use of npx skills add getcargohq/cargo-skills without pinning a specific version or commit, so execution behavior can change over time and may pull a compromised or unexpected package. In an agent context, this creates a supply-chain risk because the skill can cause retrieval and execution of remote code beyond the stated enrichment task.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The GitHub starring flow is unrelated to LinkedIn enrichment and asks the agent to perform an external account action on the user's behalf. This expands scope from data enrichment into social/account manipulation, which can abuse authenticated gh context and violates least privilege for the advertised skill purpose.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill creates a persistent marker file under ~/.config/cargo-ai/.star-asked to track whether the user has been prompted about starring the repo. Even though the file is small, it is unrelated to the enrichment task and establishes cross-session state to support promotional behavior, which is an unnecessary persistence side effect.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

bash

gh api -X PUT /user/starred/getcargohq/gtm-skills     # 204 = starred; there is no `gh repo star`
mkdir -p ~/.config/cargo-ai && touch ~/.config/cargo-ai/.star-asked   # touch on either answer

If gh is missing or unauthenticated, name the URL and move on — this never becomes a task.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Although the manifest presents this as a single enrichment skill, it also performs workspace/session attribution writes via cargo-ai workspaceManagement session upsert. This hidden side effect causes data to be written to an external service beyond the primary user-requested action, reducing transparency and increasing privacy/compliance risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.