Linkedin Monitor
Analysis
This skill is purpose-aligned for LinkedIn monitoring, but it asks for high-impact LinkedIn account/session access, persistent hourly monitoring, and optional autonomous replies as you.
Findings (7)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
| 2 | Auto-Reply Simple | Auto-handles acknowledgments, scheduling | | 3 | Full Autonomous | Replies as you, books meetings, networks |
The skill describes autonomous use of the user's LinkedIn account for replies, scheduling, and networking, which are high-impact actions with unclear approval, rollback, or containment controls outside Level 1.
🛡️ **Approval required** — Nothing sent without your OK ... | 2 | Auto-reply simple — handles "thanks", scheduling automatically | | 3 | Full autonomous — replies as you, books meetings |
The README makes a broad approval-required claim while also documenting autonomy modes that send or act automatically, creating a material ambiguity about whether messages can be sent without explicit approval.
Enable Hourly Monitoring ```bash linkedin-monitor enable ``` Done! The monitor will now check your inbox every hour.
The skill intentionally creates persistent hourly monitoring via cron. This is disclosed and purpose-aligned, but it means the skill continues operating in the background after setup.
"requires": {
"tools": ["browser", "cron", "message"],
"bins": ["jq"]
}The package declares browser, cron, message, and jq requirements, while the registry section reports no required binaries, env vars, config paths, or capability tags. This looks like under-declared metadata rather than hidden behavior.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
li_at = os.environ.get('LINKEDIN_LI_AT')
jsessionid = os.environ.get('LINKEDIN_JSESSIONID')
...
config_path = os.path.expanduser('~/.clawdbot/linkedin-monitor/credentials.json')The code uses LinkedIn session cookies from environment variables or a local credentials file, giving account-level access to the user's LinkedIn session; registry metadata declares no primary credential or env vars.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
Post to the configured channel (Discord, Telegram, Slack, WhatsApp, etc.):
Format:
📬 **{Name}**
> {message preview}
**Draft reply:**The workflow sends LinkedIn message previews and drafted replies to third-party chat channels. This is disclosed and central to alerts, but it moves private inbox content outside LinkedIn.
'inboundMessage': $message, 'draftReply': $draft, 'conversationId': $conv_id, 'createdAt': $created, 'status': "pending"
The skill stores inbound message text, draft replies, and conversation identifiers in local persistent state for approval and deduplication. This is purpose-aligned but contains private communication data.