LinkedIn Search Posts
v1.0.0Search LinkedIn posts by keywords using the Apify actor harvestapi/linkedin-post-search. Use when the user wants to search, scrape, or retrieve LinkedIn post...
⭐ 0· 205·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The stated purpose (search/scrape LinkedIn posts via the Apify actor harvestapi~linkedin-post-search) matches the SKILL.md instructions. However, the registry metadata provided to the evaluator lists no required env vars or primary credential while the SKILL.md explicitly requires APIFY_API_TOKEN. That mismatch is unexpected and reduces trust in the manifest integrity.
Instruction Scope
SKILL.md gives concrete curl calls to Apify's API and documents inputs, pagination, and result fetching. The instructions do not ask the agent to read unrelated local files, other env vars, or to transmit data to endpoints other than Apify. The scope of actions (start run, poll run, fetch dataset) is consistent with the described purpose.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, which minimizes on-disk risk. The skill relies on outbound network calls to Apify as described.
Credentials
SKILL.md requires an APIFY_API_TOKEN (an account credential) which is proportionate to calling Apify, but the skill's declared requirements omitted this env var. The missing declaration is an integrity issue: users may not realize they must supply a credential, and the manifest should list APIFY_API_TOKEN (and indicate expected scope/permissions).
Persistence & Privilege
The skill is not always-enabled and allows normal autonomous invocation. It does not request to modify other skills or system configuration. No elevated persistence is requested.
What to consider before installing
Before installing: (1) Demand that the skill manifest be updated to declare APIFY_API_TOKEN as a required environment variable so the registry and runtime agree. (2) Understand that this token grants the skill the ability to run Apify actors and access datasets in your Apify account — create a least-privilege token and review its permissions. (3) Verify the Apify actor (harvestapi~linkedin-post-search) and its publisher are trustworthy; confirm dataset visibility (private vs public) so scraped LinkedIn data isn't exposed unintentionally. (4) Be aware of legal/ToS and privacy implications of scraping LinkedIn and personal data; ensure compliance with your policies. (5) Because this skill will make outbound API calls, avoid providing sensitive account tokens unless you trust the actor and have validated billing/cost implications ($2/1000 posts as described). If the publisher/source is unknown or you cannot confirm the actor's behavior, treat the skill as untrusted until the manifest and provenance are clarified.Like a lobster shell, security has layers — review code before you run it.
latestvk9762hsc74vghgmqc1pzvq9y8182ea8g
License
MIT-0
Free to use, modify, and redistribute. No attribution required.