Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Keyapi Linkedin User Analytics

v1.0.0

Discover, profile, and deeply analyze LinkedIn users — explore professional profiles, contact information, work experience, education, skills, publications,...

0· 10·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description (LinkedIn user analytics) matches the implementation: a Node.js runner that calls a KeyAPI MCP server using KEYAPI_TOKEN and the @modelcontextprotocol/sdk. Required binary (node) and dependency are proportional to the task; no unrelated cloud credentials or binaries are requested.
Instruction Scope
SKILL.md instructs running npm install and the node runner against the KeyAPI MCP server. The runtime also loads/saves a .env file, writes cached responses to .keyapi-cache, and can write output files — all of which are within scope for a CLI tool but do mean profile data (potentially PII) and the token may be stored on disk.
Install Mechanism
No automated install spec in the registry; user-run npm install is required. The only dependency is @modelcontextprotocol/sdk from npm, which is expected for an MCP client. No remote arbitrary binary downloads were found in the included files.
Credentials
Only KEYAPI_TOKEN is required and designated as primaryEnv, which is appropriate. However the tool will persist the token into a .env file in the skill directory (unencrypted) and cache API responses locally — this increases risk of accidental leakage of credentials or collected profile data.
Persistence & Privilege
The skill does not request always:true and does not modify other skills. It persists its own .env and cache files within the skill directory (normal for a CLI tool), which is not an elevated platform privilege but is noteworthy for data retention.
Assessment
This skill appears to do what it claims: it calls KeyAPI's MCP to fetch LinkedIn profile and content data and requires only KEYAPI_TOKEN and Node. Before installing: (1) verify the KeyAPI service and token source you intend to use; (2) be aware the runner saves your KEYAPI_TOKEN to a .env file in the skill directory and writes cached API responses to .keyapi-cache — these files may contain sensitive PII or credentials, so protect or avoid sharing the skill directory; (3) confirm you have the legal/right-to-scrape consent and that using gathered contact data complies with privacy policies and LinkedIn terms; (4) inspect package.json and scripts/run.js locally (you already have them) and consider running in an isolated environment or container if you don’t trust the provider; (5) if you prefer not to persist the token, set KEYAPI_TOKEN in your environment for the session and avoid interactive prompt/save behavior.
scripts/run.js:52
Environment variable access combined with network send.
!
scripts/run.js:37
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk976qspk5gryykk9jv7q97txjh8422bx

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

👔 Clawdis
Binsnode
EnvKEYAPI_TOKEN
Primary envKEYAPI_TOKEN

SKILL.md

keyapi-linkedin-user-analytics

Discover, profile, and deeply analyze LinkedIn professionals — from identity resolution and career history to content activity, social graph metrics, and interest mapping.

This skill provides comprehensive LinkedIn user intelligence using the KeyAPI MCP service. It enables retrieval of full professional profiles, contact details, follower/connection counts, published posts, comments, videos, images, work experience, education, skills, certifications, publications, honors, recommendations, and interest groups — all through a unified, cache-first workflow.

Use this skill when you need to:

  • Retrieve a complete professional profile for a LinkedIn user by username
  • Audit a user's career history, education background, and skill endorsements
  • Analyze a professional's published content — posts, comments, videos, and images
  • Research contact information, follower counts, and connection network size
  • Discover a user's certifications, publications, honors, and recommendations
  • Map professional interests via followed groups and companies
  • Search and discover LinkedIn professionals by name, title, company, or industry

author: KeyAPI license: MIT repository: https://github.com/EchoSell/keyapi-skills

Prerequisites

RequirementDetails
KEYAPI_TOKENA valid API token from keyapi.ai. Register at the site to obtain your free token. Set it as an environment variable: export KEYAPI_TOKEN=your_token_here
Node.jsv18 or higher
DependenciesRun npm install in the skill directory to install @modelcontextprotocol/sdk

author: KeyAPI license: MIT repository: https://github.com/EchoSell/keyapi-skills

MCP Server Configuration

All tool calls in this skill target the KeyAPI LinkedIn MCP server:

Server URL : https://mcp.keyapi.ai/linkedin/mcp
Auth Header: Authorization: Bearer $KEYAPI_TOKEN

Setup (one-time):

# 1. Install dependencies
npm install

# 2. Set your API token (get one free at https://keyapi.ai/)
export KEYAPI_TOKEN=your_token_here

# 3. List all available tools to verify the connection
node scripts/run.js --platform linkedin --list-tools

author: KeyAPI license: MIT repository: https://github.com/EchoSell/keyapi-skills

Analysis Scenarios

User NeedNode(s)Best For
Full profile snapshot with optional sectionsget_user_profileProfile audit, identity resolution, one-call enrichment
Personal bio / about sectionget_user_aboutNarrative summary, career positioning
Contact details (email, phone, social links)get_user_contact_informationOutreach research, lead enrichment
Follower and connection countsget_user_follower_and_connectionInfluence sizing, network reach
Published posts with engagementget_user_postsContent strategy analysis, thought leadership audit
Comments activityget_user_commentsEngagement behavior, community participation
Published videosget_user_videosVideo content inventory, media presence
Published imagesget_user_imagesVisual content audit
Work experience historyget_user_experienceCareer trajectory, employer history
Skill endorsementsget_user_skillsCompetency mapping, talent assessment
Education backgroundget_user_educationsAcademic credentials, institutional affiliations
Publications and researchget_user_publicationsThought leadership, academic output
Professional certificationsget_user_certificationsCredential verification, compliance checks
Honors and awardsget_user_honorsAchievement profiling, recognition history
Peer recommendationsget_user_recommendationsSocial proof, reputation signals
Followed interest groupsget_user_interests_groupsCommunity affiliations, niche interests
Followed companiesget_user_interests_companiesIndustry focus, competitive intelligence
Search professionals by name, title, or companysearch_peopleTalent discovery, prospect research

author: KeyAPI license: MIT repository: https://github.com/EchoSell/keyapi-skills

Workflow

Step 1 — Identify Analysis Targets and Select Nodes

Clarify the research objective and map it to one or more nodes. Typical entry points:

  • Profile lookup: Use get_user_profile with username. Enable include_* flags to fetch additional sections in a single call.
  • Content audit: Combine get_user_posts + get_user_comments + get_user_videos + get_user_images.
  • Career deep-dive: Use get_user_experience + get_user_educations + get_user_skills + get_user_certifications.
  • Reputation research: Use get_user_recommendations + get_user_honors + get_user_publications.
  • Interest mapping: Use get_user_interests_groups + get_user_interests_companies.
  • People discovery: Use search_people with name, title, company, or industry filters.

Critical: Two Identifier Types

LinkedIn endpoints use two distinct identifiers:

  • username — the handle from the profile URL (e.g., https://www.linkedin.com/in/jackjack). Used by get_user_profile, get_user_contact_information, get_user_follower_and_connection.
  • urn — an internal opaque identifier (e.g., ACoAABCtiL8B26nfi3Nbpo_AM8ngg4LeClT1Wh8). Required by all other user nodes.

Always call get_user_profile first with the username to obtain the urn before calling any urn-based endpoint.

get_user_profile Efficiency Tip

get_user_profile supports optional include_* boolean flags: include_follower_and_connection, include_experiences, include_skills, include_certifications, include_publications, include_educations, include_volunteers, include_honors, include_interests, include_bio. Enable these to retrieve multiple sections in a single API call and reduce total request count.

Step 2 — Retrieve API Schema

Before calling any node, inspect its input schema to confirm required parameters and available options:

node scripts/run.js --platform linkedin --schema <tool_name>

# Examples
node scripts/run.js --platform linkedin --schema get_user_profile
node scripts/run.js --platform linkedin --schema search_people

Step 3 — Call APIs and Cache Results Locally

Execute tool calls and persist responses to the local cache to avoid redundant API calls.

Calling a tool:

# Single call with pretty output
node scripts/run.js --platform linkedin --tool <tool_name> \
  --params '<json_args>' --pretty

# Force fresh data, skip cache
node scripts/run.js --platform linkedin --tool <tool_name> \
  --params '<json_args>' --no-cache --pretty

Example — get full profile with experience and skills:

node scripts/run.js --platform linkedin --tool get_user_profile \
  --params '{"username":"jack","include_experiences":true,"include_skills":true}' --pretty

Example — get user posts (first page):

node scripts/run.js --platform linkedin --tool get_user_posts \
  --params '{"urn":"ACoAABCtiL8B26nfi3Nbpo_AM8ngg4LeClT1Wh8","page":1}' --pretty

Example — get next page using pagination token:

node scripts/run.js --platform linkedin --tool get_user_posts \
  --params '{"urn":"ACoAABCtiL8B26nfi3Nbpo_AM8ngg4LeClT1Wh8","page":2,"pagination_token":"<token_from_previous_response>"}' --pretty

Example — search people by title and company:

node scripts/run.js --platform linkedin --tool search_people \
  --params '{"title":"CEO","company":"OpenAI","page":1}' --pretty

Example — get received recommendations:

node scripts/run.js --platform linkedin --tool get_user_recommendations \
  --params '{"urn":"ACoAAC3iNKcB3qbWJrP7K5Z3i89AF5c1snr8bhc","type":"received","page":1}' --pretty

Pagination:

Most user content endpoints use a hybrid pagination model:

Endpoint groupPagination parametersNotes
get_user_posts, get_user_comments, get_user_videos, get_user_images, get_user_recommendationspage (int, 1-indexed) + pagination_tokenPass pagination_token from previous response for pages > 1
get_user_experience, get_user_skills, get_user_educations, get_user_publications, get_user_certifications, get_user_honors, get_user_interests_groups, get_user_interests_companiespage (int, 1-indexed)No token required
search_peoplepage (int, 1-indexed)No token required
get_user_profile, get_user_about, get_user_contact_information, get_user_follower_and_connectionSingle-call response

Cache directory structure:

.keyapi-cache/
└── YYYY-MM-DD/
    ├── get_user_profile/
    │   └── {params_hash}.json
    ├── get_user_about/
    │   └── {params_hash}.json
    ├── get_user_contact_information/
    │   └── {params_hash}.json
    ├── get_user_follower_and_connection/
    │   └── {params_hash}.json
    ├── get_user_posts/
    │   └── {params_hash}.json
    ├── get_user_comments/
    │   └── {params_hash}.json
    ├── get_user_videos/
    │   └── {params_hash}.json
    ├── get_user_images/
    │   └── {params_hash}.json
    ├── get_user_experience/
    │   └── {params_hash}.json
    ├── get_user_skills/
    │   └── {params_hash}.json
    ├── get_user_educations/
    │   └── {params_hash}.json
    ├── get_user_publications/
    │   └── {params_hash}.json
    ├── get_user_certifications/
    │   └── {params_hash}.json
    ├── get_user_honors/
    │   └── {params_hash}.json
    ├── get_user_recommendations/
    │   └── {params_hash}.json
    ├── get_user_interests_groups/
    │   └── {params_hash}.json
    ├── get_user_interests_companies/
    │   └── {params_hash}.json
    └── search_people/
        └── {params_hash}.json

Cache-first policy:

Before every API call, check whether a cached result already exists for the given parameters. If a valid cache file exists, load from disk and skip the API call.

Step 4 — Synthesize and Report Findings

After collecting all API responses, produce a structured professional intelligence report:

For individual profile analysis:

  1. Profile Overview — Name, username, URN, headline, location, follower count, connection count, verification status.
  2. Career Summary — Work experience timeline, current and past employers, tenure patterns, career progression.
  3. Education & Credentials — Academic institutions, degrees, certifications, publications, honors.
  4. Skills & Endorsements — Top endorsed skills, skill categories, competency breadth.
  5. Content Activity — Post frequency, engagement patterns, video and image publishing cadence.
  6. Reputation Signals — Received recommendations, honors, community recognition.
  7. Interest Profile — Followed groups and companies, industry focus areas.

For discovery / shortlist building:

  1. Search Results — Matched professionals with headline, company, location.
  2. Comparative Overview — Side-by-side profile metrics for shortlisted candidates.
  3. Actionable Recommendations — Best-fit profiles for outreach, partnership, or hiring.

author: KeyAPI license: MIT repository: https://github.com/EchoSell/keyapi-skills

Common Rules

RuleDetail
Identifier resolutionusername is used by get_user_profile, get_user_contact_information, get_user_follower_and_connection. All other user nodes require urn — always call get_user_profile first to obtain it.
get_user_profile flagsUse include_* boolean flags to fetch multiple profile sections in a single call and minimize API usage.
get_user_educations quirkThe API schema marks urn as optional for this endpoint (no required constraint), but in practice a valid urn is needed to return meaningful data. Always pass urn.
get_user_recommendations typePass type: "received" (default) or type: "given" to control which direction of recommendations is returned.
PaginationUse page (1-indexed) for all paginated endpoints. Pass pagination_token from the previous response for content endpoints (posts, comments, videos, images, recommendations).
search_people filtersCombine name, title, company, school, industry, geocode_location, current_company, profile_language, service_category for precise targeting. All filters are optional.
Success checkcode = 0 → success. Any other value → failure. Always check the response code before processing data.
Retry on 500If code = 500, retry the identical request up to 3 times with a 2–3 second pause between attempts before reporting the error.
Cache firstAlways check the local .keyapi-cache/ directory before issuing a live API call.

author: KeyAPI license: MIT repository: https://github.com/EchoSell/keyapi-skills

Error Handling

CodeMeaningAction
0SuccessContinue workflow normally
400Bad request — invalid or missing parametersValidate input against the tool schema; ensure username or urn is correctly provided
401Unauthorized — token missing or expiredConfirm KEYAPI_TOKEN is set correctly; visit keyapi.ai to renew
403Forbidden — plan quota exceeded or feature restrictedReview plan limits at keyapi.ai
404Resource not found — user may not exist or profile is privateVerify the username; private or restricted profiles may return limited data
429Rate limit exceededWait 60 seconds, then retry
500Internal server errorRetry up to 3 times with a 2–3 second pause; if it persists, log the full request and response and skip this node
Other non-0Unexpected errorLog the full response body and surface the error message to the user

Files

3 total
Select a file
Select a file to preview.

Comments

Loading comments…