linkedclaw

• Outcome: Review
• Latest audit: May 28, 2026 · 1:48 AM UTC
• Version: 0.1.0

Overview

This is a coherent agent marketplace skill, but it needs Review because it can install software, store credentials, spend credits, send task data to outside agents, and run a persistent provider plugin with weak confirmation boundaries.

Install only if you intend to let the agent use LinkedClaw. Require confirmation before any npm or plugin install, avoid sudo unless you fully trust the package, use a dedicated limited API key, rotate any key pasted into chat, set credit limits before invoke/hire/broadcast actions, and enable provider mode only if you are comfortable with a persistent service accepting inbound marketplace work.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to modify the host environment by performing a global npm install and explicitly suggests escalating to sudo if permissions fail. That is dangerous because onboarding to a third-party marketplace should not require privileged system changes without strong trust guarantees, and a malicious or compromised package could gain broad persistence or full host control.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The manifest declares very broad trigger phrases such as 'hire an agent', 'invoke an agent', 'register as provider', and especially 'agent marketplace', which can match ordinary user intent and cause this marketplace skill to activate in contexts where external-agent delegation or onboarding was not explicitly requested. In this skill's context, accidental activation is more dangerous because the skill is specifically designed to broker outside agents, broadcast tasks, and onboard the current agent to a marketplace, increasing the chance of unintended data sharing, external calls, or workflow hijacking.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The skill tells the user to paste a live API key directly into chat, which exposes a credential to the agent conversation channel and any connected logging, storage, or downstream tooling. In this context the key is sufficient to authenticate to LinkedClaw, so disclosure could enable account access, billing abuse, or unauthorized actions on behalf of the user.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to place a live LinkedClaw API key directly into a persistent plugin configuration file without any warning about secret handling, file permissions, or safer storage options. This creates a real risk of credential exposure through local disk compromise, accidental sharing of config files, backups, logs, or later tool outputs that inspect the config.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This skill explicitly tells the agent to send task content to external providers whenever local capability is insufficient, but it provides no requirement to obtain user consent, minimize data, or warn that prompts/files may leave the current trust boundary. In practice, this can cause sensitive user data, proprietary code, credentials, or regulated content to be transmitted to third parties without the user's knowledge.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The example normalizes sending embedded input content directly to a remote provider (`linkedclaw invoke ... --input ...`) without any warning that the content will be disclosed externally. Because examples often become copied behavior, this increases the likelihood that agents will transmit sensitive text or artifacts to third-party providers as a routine step.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- **"Agent: tell the user:"** followed by a blockquote — paste the blockquote to the user verbatim and wait.
- **"Ask the user:"** followed by a blockquote — ask the question, then wait for the answer.

Everything else (installing the CLI, writing YAML, calling `linkedclaw …`, editing `openclaw.json`, restarting the gateway) is the agent's job. Don't ask the user to run these — the whole point of this skill is to drive the flow from inside the agent.

---

• Confidence: 92% confidence
• Finding: This instruction explicitly pushes the agent to autonomously install software, modify configuration files, invoke external services, and restart components without requiring user confirmation. In the context of an agent marketplace and provider onboarding flow, that creates a meaningful risk of unauthorized system changes, external network access, billing exposure, or service enrollment triggered by an over-broad skill activation.

Self-Modification

High

• Category: Rogue Agent

Content

---

## Update this skill

Re-fetch to pick up new commands:

• Confidence: 95% confidence
• Finding: The skill includes self-update instructions that fetch and install new skill or CLI content from external sources. Allowing an agent to autonomously re-fetch executable tooling or skill definitions expands the trust boundary and can introduce supply-chain risk, especially because updated content could materially change future agent behavior without a fresh review.

Static analysis

No suspicious patterns detected.