Security audit

LinkedIn Automator

Security checks for vulnerabilities and agentic risk

Overview

This LinkedIn skill is purpose-aligned, but it needs Review because it can affect a real logged-in account and can create future main-session posting instructions without strong confirmation or data boundaries.

Install only if you are comfortable letting an agent operate a logged-in LinkedIn session. Review and explicitly approve every post, comment, upload, engagement action, and scheduled job before execution; avoid using untrusted post content or topics; and prefer isolated, one-time workflows over main-session cron events.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/schedule.sh:27
Finding: Untrusted Input Is Embedded in Privileged Agent Instructions and Scheduled Events
Content: View full analysis
}, "payload": { "kind": "systemEvent", "text": "Post to LinkedIn now: $CONTENT" }, "sessionTarget": "main" } \`\`\` Or use cron expression for recurring posts: - Daily at 9am: "0 9 * * *" - Weekdays at 9am: "0 9 * * 1-5" - Mon/Wed/Fri at 2pm: "0 14 * * 1,3,5" ## Quick Setup Convert your desired time to Unix milliseconds: \`date -d "$SCHEDULE_TIME" +%s000\` Then create the cron job via the OpenClaw cron tool. ...[truncated 4461 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description presents a broad LinkedIn automation and analytics capability, including creating and posting content, scheduling, tracking engagement metrics, and building audience presence. The actual code chunk merely echoes a static set of instructions for manually engaging with LinkedIn posts, with optional limit/topic text interpolation. It does not access LinkedIn, automate browser actions, generate content, schedule posts, collect metrics, or persist tracking data. This is a material description-to-behavior mismatch because the primary purpose and capabilities are substantially narrower and more manual than declared.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a broad LinkedIn automation and analytics skill, but the supplied code only formats and displays a scheduling template plus guidance for using an external cron tool. Its primary behavior is instructional/output generation, not LinkedIn automation. This is a material mismatch because the code neither accesses LinkedIn nor performs posting, tracking, commenting, analytics, or audience-building actions described in the purpose.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 94% confidence
Finding: The script emits browser-executable workflow instructions that include untrusted user-controlled content directly in the generated prompt block. This creates a prompt-injection boundary failure: if CONTENT contains adversarial text, an agent consuming this output may follow embedded instructions, exfiltrate data, or perform unintended browser actions while authenticated to LinkedIn.
Content: Scanner excerpt · scripts/post.sh (reported line 29)May include surrounding context.
sh
exit 1 fi # Output instructions for the agent to execute via browser tool cat << EOF 📝 LINKEDIN POST WORKFLOW ═══════════════════════════════════════

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill description is broad enough to trigger on common social-media or writing requests, which can cause automation to be invoked in situations where the user likely wanted advice rather than account-affecting actions. In the context of a logged-in LinkedIn browser session, this increases the chance of unintended posting or engagement actions against a real account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation encourages automated posting, commenting, and engagement on a logged-in LinkedIn account without prominently warning about account-impacting behavior, rate limits, terms-of-service risk, or the need for explicit approval. Because the skill operates in a browser session tied to a real user account, misuse could lead to unauthorized actions, reputational harm, or account restrictions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The top-level description does not clearly separate when the skill should automate LinkedIn actions versus when it should provide general strategy advice. In a live browser-authenticated context, that ambiguity is risky because routine content-help prompts could escalate into real account actions without sufficiently clear consent boundaries.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.