T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:255- Finding
Excessive LinkedIn Organization Administration Permission
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 255
Vulnerability Type: Excessive privilege request
Risk Level: Mediummarkdown - Requires `administer_organization` permissionTechnical Analysis
The skill primarily describes read-oriented campaign performance analysis, including retrieving advertising metrics and detecting copy fatigue. However, it requires LinkedIn's
administer_organizationpermission, which grants organization-administration capabilities beyond those needed for read-only advertising analytics.This violates the principle of least privilege. The broader authorization also increases the security impact of the optional automated A/B testing and third-party workflow features described elsewhere in the skill. Although the package contains no executable implementation and no evidence that this permission is actively abused, users following the documented setup could grant an agent or integration unnecessary administrative access.
Attack Path
- A user follows the skill's configuration instructions and authorizes LinkedIn access.
- The integration receives a token containing organization-administration privileges.
- The token is made available to the configured agent, OAuth client, or connected automation service.
- If that component, its workflow, or the token is compromised, the administrative scope can be used for operations beyond campaign-performance analysis.
- The attacker may retain access until the token expires or the user explicitly revokes the authorization.
Impact Assessment
A compromised integration could potentially exercise LinkedIn organization-level capabilities beyond the skill's stated analytical purpose. The precise operations available depend on LinkedIn's current scope definitions, token configuration, organization role assignments, and API enforcement.
The affected scope includes organizations connected through the authorized LinkedIn ac ...[truncated 229 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace
administer_organizationwith the narrowest LinkedIn advertising-reporting or analytics scope that supports the required read operations. - Document every requested OAuth scope, the feature that needs it, and whether it permits reading or writing.
- Separate read-only fatigue analysis from optional campaign-modification functionality.
- Require a distinct authorization flow and explicit user confirmation before granting any write or organization-administration scope.
- Use short-lived access tokens where supported and provide documented revocation and rotation procedures.
- Restrict tokens to the required advertising accounts and organizations rather than granting account-wide access.
- Add an authorization check before every modifying operation and display the exact proposed changes for user approval.
- Avoid exposing tokens to third-party automation platforms unless necessary; when required, use scoped credentials and audit all resulting API activity.
- Replace