Content Repurpose to LinkedIn

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:15 AM UTC
• Version: 1.0.6

Overview

The skill’s LinkedIn-posting purpose is coherent, but it needs Review because setup installs and allowlists an unpinned third-party plugin that can mediate LinkedIn account actions.

Review the ClawLink plugin provenance before installing. Prefer a pinned, verified version, confirm the LinkedIn OAuth scopes, and only proceed if you are comfortable granting a persistent plugin access to mediate posting to your LinkedIn profile or organization page.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47

Finding

Unpinned Third-Party Plugin Installed with LinkedIn Posting Capability

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47–49
Vulnerability Type: Unpinned third-party dependency from an externally managed package source
Risk Level: Medium

Vulnerable Code

bash

openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

The same allowlisting and restart instructions are repeated in SKILL.md at lines 189–190:

bash

openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The Skill instructs the user or agent to install clawhub:clawlink-plugin without specifying an immutable version, integrity digest, or cryptographic signature. It then explicitly allowlists the plugin and restarts the OpenClaw gateway, causing the externally supplied component to be loaded.

The plugin implementation is not included in the audited project, so its behavior cannot be verified from the available source. The Skill also states that ClawLink handles hosted credentials and proxies LinkedIn requests. Once connected, the dependency operates across a sensitive trust boundary and can participate in account-level publishing operations.

An unpinned package reference can resolve to implementation code that changes after this Skill has been reviewed. If the package source, publisher account, distribution channel, or a future release is compromised, the documented installation process may load attacker-controlled code. The Skill’s requirement for confirmation before intended publishing actions reduces accidental-posting risk but does not constrain malicious behavior during plugin initialization or execution.

Attack Path

1. An attacker compromises the package publisher, registry entry, distribution infrastructure, or a future release associated with clawhub:clawlink-plugin.
2. The unversioned package reference begins resolvi ...[truncated 1240 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to a reviewed, immutable version rather than installing an unversioned package reference.
2. Require verification using a cryptographic digest or trusted package signature before installation.
3. Document the expected publisher identity, package provenance, version, and verification procedure.
4. Review the plugin source and release artifacts before allowlisting it.
5. Restrict plugin capabilities and OAuth scopes to the minimum LinkedIn operations required for the task.
6. Require explicit user approval before plugin installation, configuration changes, gateway restart, OAuth connection, and each state-changing LinkedIn action.
7. Isolate the plugin in a constrained runtime with limited filesystem, network, credential, and process permissions.
8. Avoid automatically loading future or dynamically changed releases without renewed integrity and security review.
9. Record and surface the exact installed version and integrity value so users can verify what code is active.
10. Update the repeated troubleshooting commands at lines 189–190 to preserve the same version pinning and verification controls.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.