ClawHub
Back to skill

Security audit

Linkedin Content Optimizer Engagement Booster

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a LinkedIn growth guide, but it encourages broad contact profiling and automated outreach without enough privacy, consent, or platform-compliance boundaries.

Review this before installing if you plan to use it for real LinkedIn outreach. Use least-privilege tokens, avoid entering optional Slack/HubSpot/Sheets credentials unless needed, keep messages human-reviewed, do not run bulk unsolicited campaigns, and avoid profiling or referencing people in ways they would not reasonably expect.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Ae1

High
Category
analysis-evasion
Content
{"openclaw":{"requires":{"env":["LINKEDIN_API_KEY","OPENAI_API_KEY"],"bins":["curl","jq"]},"os":["macos","linux","win32"],"files":["SKILL.md"],"emoji":"🔗"}}
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Memory Manipulation

High
Category
Memory Poisoning
Content
- **Pro Tip**: Test posting at the recommended time for 2 weeks before adjusting—one week isn't enough data

### 2. **Content Rewriting Best Practices**
- Always start with your authentic voice—don't let AI completely rewrite your personality
- Use Version 1 for thought leadership, Version 2 for personal/vulnerable content, Version 3 for announcements
- Test CTAs: "Drop a comment" drives engagement; "Schedule a call" drives conversions
- **Pro Tip**: Pair AI rewrites with your unique data/stories—"We analyzed 10,000 X and found Y" outperforms generic advice
Confidence
80% confidence
Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The description promotes automated outreach and re-engagement sequences without warning about consent, anti-spam obligations, or LinkedIn platform-policy limits. In a growth-automation context, this increases the risk that users will deploy bulk or deceptive contact patterns that trigger abuse, complaints, or account sanctions.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill encourages analysis of detailed LinkedIn behavioral and connection data without any privacy notice, consent boundary, or data-minimization guidance. In this context, the agent could normalize collection and profiling of personal engagement data in ways that violate user expectations, platform rules, or internal privacy policies.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The skill presents Google Sheets, Slack, and HubSpot as key integrations and describes automated reporting/notifications/sync, which materially expands the claimed behavior. However, the rest of the skill file provides only environment variables and setup verification for LinkedIn and OpenAI, with no concrete commands, workflows, or code-like steps showing those additional integrations are actually used.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The examples explicitly encourage using recent activity, liked posts, and mutual connections to personalize outreach, but provide no warning about sensitivity, creepiness, or appropriate-use limits. That combination can facilitate invasive profiling and manipulative social engineering-style messaging, especially when automated at scale.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Verify LinkedIn API connection
curl -H "Authorization: Bearer $LINKEDIN_ACCESS_TOKEN" \
  https://api.linkedin.com/v2/me

# Verify OpenAI API
curl https://api.openai.com/v1/models \
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
https://api.linkedin.com/v2/me

# Verify OpenAI API
curl https://api.openai.com/v1/models \
  -H "Authorization: Bearer $OPENAI_API_KEY"
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Intent-Code Divergence

Low
Confidence
91% confidence
Finding
This statement describes autonomous analysis as if the skill performs it directly, yet the file contains descriptive markdown, examples, and setup notes rather than executable automation. That is a direct contradiction between the documentation's asserted behavior and what this skill file actually provides.

Missing User Warnings

Low
Confidence
85% confidence
Finding
The configuration lists several sensitive credentials and a webhook URL pattern but gives no guidance on secure storage, rotation, least privilege, or avoiding accidental disclosure. While not an immediate secret leak, normalizing insecure credential handling increases the chance of key exposure and downstream compromise of third-party services.

Static analysis

No suspicious patterns detected.