T09 · Insecure Skill Coding Practices
Error
- Location
scripts/lk.py:145- Finding
LinkedIn Session Cookies Stored in Plaintext Without Enforced Access Controls
- Content
View full analysis
- Remediation
View remediation
Security audit
Linkedin Monitor
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent LinkedIn inbox monitor, but it asks for persistent access to a logged-in LinkedIn account and external messaging channels with under-scoped safeguards for credentials, automatic actions, and untrusted message content.
Review before installing. Use only a dedicated LinkedIn browser profile, avoid autonomous levels 2 and 3 unless you accept messages being sent as you, and do not store LinkedIn session cookies in plaintext. Confirm exactly which alert channel receives private message previews and drafts, and disable cron/remove local state when you no longer need monitoring.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T01 · Skill Instruction Hijacking
Error
- Location
CRON-PAYLOAD.md:12- Finding
Indirect Prompt Injection Through Attacker-Controlled LinkedIn Messages
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:150- Finding
Unpinned and Globally Installed Third-Party Dependencies
- Content
View full analysis
/dev/null; then log "ERROR" "lk CLI not installed" echo '{"error": "lk CLI not installed", "action": "install lk: npm install -g lk"}' exit 1 fi if ! lk profile me --json 2>/dev/null | jq -e '.id' &>/dev/null; then ``` ### Technical Analysis The installation guidance identifies npm and pip packages only by mutable package name. It provides no exact version, lockfile, integrity hash, verified publisher identity, or reproducible environment. The npm package is installed globally, increasing its exposure and making it available outside this Skill. The implementation also contains an architectural inconsistency: documentation directs users to install the npm `lk` CLI, while `scripts/lk.py` uses the separate Python `linkedin-api` package. The packaged Python file is not explicitly bound to the `lk` command used by `check.sh`. At runtime, `check.sh` invokes whichever executable named `lk` appears first in the cron process's `PATH`. A compromised package release, package-name confusion, or local PATH-precedence attack could therefore substitute attacker-controlled behavior. ### Attack Path #### Package Supply-Chain Path 1. A user follows the documented `npm install -g lk` or suggested `pip3 install lin ...[truncated 1693 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (44)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
clawdhub uninstall linkedin-monitor
(Optional) Remove data
rm -rf ~/.clawdbot/linkedin-monitor
text ---
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
clawdhub uninstall linkedin-monitor
(Optional) Remove data
rm -rf ~/.clawdbot/linkedin-monitor
text ---
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the real behavior includes interactive credential harvesting or storage that is not disclosed in the description, that is a serious trust and transparency issue. Users may provide credentials under false assumptions about the skill’s scope, and undocumented account-access flows materially increase the risk of credential mishandling or abuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
If the real behavior includes interactive credential harvesting or storage that is not disclosed in the description, that is a serious trust and transparency issue. Users may provide credentials under false assumptions about the skill’s scope, and undocumented account-access flows materially increase the risk of credential mishandling or abuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the real behavior includes interactive credential harvesting or storage that is not disclosed in the description, that is a serious trust and transparency issue. Users may provide credentials under false assumptions about the skill’s scope, and undocumented account-access flows materially increase the risk of credential mishandling or abuse.
- Content
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
linkedin-monitor status # Show current state linkedin-monitor config # View/edit configuration linkedin-monitor logs # View recent activity linkedin-monitor reset # Clear state (start fresh)
text ## Configuration
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
linkedin-monitor status # Show current state linkedin-monitor config # View/edit configuration linkedin-monitor logs # View recent activity linkedin-monitor reset # Clear state (start fresh)
text ## Configuration
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
linkedin-monitor status # Show current state linkedin-monitor config # View/edit configuration linkedin-monitor logs # View recent activity linkedin-monitor reset # Clear state (start fresh)
text ## Configuration
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The guide says the alert includes a draft reply and that the user can reply with a command to approve and send, but it does not prominently warn that the skill can act on the user's behalf on LinkedIn. In an agent skill with progressive autonomy, insufficient disclosure of outbound autonomous or semi-autonomous messaging materially increases the risk of unauthorized, mistaken, or reputation-damaging communications.
- Content
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
Check what the monitor sees
linkedin-monitor check --debug
If needed, reset state
linkedin-monitor reset
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
This finding correctly identifies a destructive shell command operating on a user directory subtree. Even though the path is more specific than 'rm -rf ~', documenting such a command without strong guardrails is risky because copy-paste execution in support workflows can cause permanent deletion of configuration, logs, and state.
- Content
bash linkedin-monitor disable linkedin-monitor reset rm -rf ~/.clawdbot/linkedin-monitor linkedin-monitor setup linkedin-monitor enable
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
This finding correctly identifies a destructive shell command operating on a user directory subtree. Even though the path is more specific than 'rm -rf ~', documenting such a command without strong guardrails is risky because copy-paste execution in support workflows can cause permanent deletion of configuration, logs, and state.
- Content
bash linkedin-monitor disable linkedin-monitor reset rm -rf ~/.clawdbot/linkedin-monitor linkedin-monitor setup linkedin-monitor enable
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 96% confidence
- Finding
The script outputs a prompt-like instruction block for an agent to browse LinkedIn, parse messages, update state, draft replies in the user's voice, and post results. This is a true prompt-execution surface because unstructured instructions are being handed to downstream automation with authority to access external content and perform write actions, increasing the risk of prompt injection, unintended data extraction, and unauthorized autonomous messaging.
- Content
sh # This script is called by the cron, which then invokes Clawdbot # to do the browser work and parse results # Output instruction for Clawdbot cron cat << 'EOF' LINKEDIN_BROWSER_CHECK Instructions for Clawdbot:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
This code reads authentication cookies from a local credentials file, which is credential access behavior even if done for the tool's stated purpose. In the context of a monitoring skill, consuming stored browser-session material is dangerous because any code path that can access the file can impersonate the user on LinkedIn.
- Content
python if not li_at or not jsessionid: # Try loading from config config_path = os.path.expanduser('~/.clawdbot/linkedin-monitor/credentials.json') if os.path.exists(config_path): with open(config_path) as f: creds = json.load(f)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
This code persists LinkedIn session cookies to a local credentials file, creating a durable stash of reusable authentication material. Because these values are sufficient to act as the user, file theft or accidental exposure can directly lead to account takeover and unauthorized message access.
- Content
python config_dir = os.path.expanduser('~/.clawdbot/linkedin-monitor') os.makedirs(config_dir, exist_ok=True) config_path = os.path.join(config_dir, 'credentials.json') with open(config_path, 'w') as f: json.dump({ 'li_at': li_at,
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - Identify INBOUND messages (where last message is NOT from me) STEP 4: Compare against state - For each inbound message, create unique ID: {name}_{timestamp} - Check if ID exists in seenIds - Collect only NEW messages (ID not in seenIds)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instructions direct the agent to forward message previews and drafted replies derived from private LinkedIn conversations to external messaging platforms, but they do not include a clear privacy warning or explicit consent step. This can leak personal, confidential, or regulated content into third-party systems with different retention, access control, and logging practices.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description frames behavior as inbox monitoring and drafting, but the cron payload broadens data delivery to arbitrary third-party channels like Discord, Telegram, Slack, and WhatsApp. That scope expansion increases data exposure risk because LinkedIn message content and AI-generated replies are transmitted outside LinkedIn without clear limitation, creating an unexpected data-sharing surface.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The opening description emphasizes inbox monitoring and notifications, but later sections describe drafting replies, auto-replying, and booking meetings. This mismatch can mislead users about the skill's actual capabilities and trust boundary, especially because it operates on a logged-in browser session tied to a real LinkedIn account.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README advertises hourly monitoring, draft generation, and approval workflows without a clear privacy warning that the skill continuously accesses LinkedIn message content. Users may not realize that private inbox data is being repeatedly read, processed, stored in state/logs, and potentially forwarded to external alerting channels.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README claims 'nothing sent without your OK' while also documenting autonomy levels that can automatically reply and book meetings. This is dangerous because users may enable the skill under a false assumption that outbound actions always require approval, leading to unintended communications from their account.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
The skill depends on a browser profile remaining logged into LinkedIn and staying open, which creates persistent authenticated session exposure. If the local environment, browser profile, or automation tooling is compromised, an attacker could inherit access to the user's LinkedIn account and messages.
- Content
md ## Setup Guide ### Step 1: Create a Browser Profile LinkedIn Monitor uses Clawdbot's browser tool to check your inbox. You need a browser profile that's logged into LinkedIn.
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Drafts are generated using your communication style from
USER.mdin your Clawdbot workspace.If you don't have a
USER.md, create one with your preferences:markdown # USER.md
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 73% confidence
- Finding
The skill advertises behavior that would require filesystem access and likely environment interaction, but it does not declare any explicit tool scope or permissions boundary. That creates ambiguity about what the skill is allowed to access and makes it harder for a runtime or reviewer to enforce least privilege, increasing the chance of overbroad file writes or secret exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill supports autonomous sending and booking actions affecting a user's LinkedIn account, calendar, and professional reputation, but the description does not prominently warn about those consequences. Users may enable higher autonomy without understanding that external communications and meetings could be initiated on their behalf.
- Content
Static analysis
No suspicious patterns detected.