Linkedin Email Phone Apify

PassAudited by ClawScan on May 1, 2026.

Overview

The skill is coherent with its stated purpose, but it uses an Apify token and sends LinkedIn URLs to external actors to retrieve personal contact data.

Before installing, confirm you are allowed to enrich the LinkedIn profiles you provide, understand that Apify actors will receive those URLs, and expect possible Apify usage costs. Use a protected APIFY_TOKEN, verify the referenced actors, and start with a small, explicitly configured batch.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

LinkedIn URL lists are sent to Apify actors, and the returned output may include emails and mobile phone numbers.

Why it was flagged

The script posts actor inputs to Apify actor endpoints; those inputs include the user-provided LinkedIn URLs. This external provider flow is disclosed and central to the skill, but users should notice the data boundary.

Skill content
base_url = f"https://api.apify.com/v2/acts/{actor_id}/run-sync-get-dataset-items" ... data=json.dumps(actor_input).encode("utf-8")
Recommendation

Use only authorized profile lists, review the Apify actors and provider terms, and avoid submitting data you are not allowed to process.

What this means

Anyone with the token could potentially use the associated Apify account within the token's permissions.

Why it was flagged

The skill requires an Apify account token and also documents passing it as a command-line argument. This is expected for Apify use, but the token can authorize actor runs and may consume account credits.

Skill content
required_env_vars:
  - APIFY_TOKEN ... python3 scripts/linkedin_email_phone_pipeline.py run \
  --apify-token 'apify_api_xxx'
Recommendation

Prefer a secret manager or environment variable, avoid pasting real tokens into shared logs or shell history, and use a limited, rotatable Apify token where possible.

What this means

A default run may perform both phone and email lookups for every provided LinkedIn URL.

Why it was flagged

The default configuration runs both enrichment branches and includes personal emails unless the user changes the toggles. This is purpose-aligned, but it can broaden the lookup and cost/data impact.

Skill content
- `includeEmails` (default `true`)
- `includePhones` (default `true`)
- `includePersonalEmails` (default `true`)
Recommendation

Set includeEmails/includePhones and personal-email options explicitly, and test with a small batch before large runs.

What this means

The behavior and data handling of the enrichment step depend on the referenced Apify actors.

Why it was flagged

The skill relies on hardcoded external Apify actors whose implementation is not included in the artifact set. The actor IDs are disclosed and central to the purpose, but they are still external dependencies.

Skill content
Phone actor: `X95BXRaFOqZ7rzjxM`
- Email actor: `q3wko0Sbx6ZAAB2xf`
...
- Actor IDs are hardcoded to your provided IDs.
Recommendation

Verify the actor pages, owners, pricing, and privacy practices before using the skill on real lead lists.