Security audit
Security checks for vulnerabilities and agentic risk
This LinkedIn outreach skill is mostly purpose-aligned, but it asks for broad account-impacting authority with unclear data-flow and scope boundaries.
Review this carefully before installing. Use it only if you are comfortable connecting LinkedIn and related accounts to HeyLead/Unipile and allowing an agent to read inbox content, draft or send outreach, publish posts, schedule meetings, and sync CRM data. Keep autopilot/full-tool modes off until you understand the account scopes, confirmations, and hosted data retention terms.
The invocation description is very broad and can match many common requests involving networking, recruiting, sales, research, posting, inbox access, and analytics. In an agentic environment, overly broad routing increases the chance this skill is auto-selected for sensitive messaging or account actions without the user fully intending those capabilities.
The skill can message people, publish posts, inspect inbox content, and access account-linked data, yet it lacks a consolidated warning about privacy, third-party data access, and account-impacting side effects. Without a prominent warning, users may authorize use without understanding that personal communications, prospect data, and public posting actions are involved.
The documentation states the hosted backend handles LinkedIn access and AI calls, while the privacy section says no messages or contacts are stored on HeyLead servers. That contradiction can mislead users about where sensitive communications and contact data transit or persist, undermining informed consent and safe deployment decisions.
The manifest limits the skill as 'not for scraping profiles in bulk,' but the full-tool mode exposes contacts, network, signals, CRM sync, and related capabilities that enable large-scale aggregation and analysis beyond narrow campaign drafting. Even if intended for outreach workflows, this broader data-access surface can be repurposed for bulk profiling and exceeds the stated user expectation.
The skill metadata says it is not for posting to company pages, but the documented create_post tool supports publishing to LinkedIn and X/Twitter without clearly constraining scope to the user's personal account. This mismatch can cause an agent or operator to invoke broader posting behavior than users were led to expect, creating unauthorized or account-impacting actions.
No suspicious patterns detected.
