ClawHub
Back to skill

Security audit

Linkedin Content

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly LinkedIn writing guidance, but it asks users to run mutable external installers and enables broad CLI actions including public posting.

Review before installing. The writing advice itself is ordinary, but do not run the curl-to-shell installer or unpinned npx related-skill commands unless you trust those publishers and have verified the installer through a safer channel. Treat infsh login and x/post-create as account-connected actions, and require explicit confirmation before any public post or third-party app execution.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:14
Finding

Unverified Remote Installer Executed Directly by Shell

Content
View full analysis
Remediation
View remediation
/ # Compare against a separately obtained, pinned expected digest. printf '%s %s\n' '' '' | sha256sum --check - # Execute only after successful verification. install -m 0755 '' "$HOME/.local/bin/infsh" ``` The actual release URL, artifact name, and expected digest must come from a trusted, immutable source rather than placeholders or a checksum downloaded from the same potentially compromised endpoint. ]]>

T08 · Insecure Dependencies

Warning
Location
SKILL.md:225
Finding

Unpinned Third-Party Skill Installation Through npx

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Granting broad Bash(infsh *) capability is excessive for a content-writing skill and materially increases attack surface. If invoked by an agent, this allows arbitrary CLI-driven external operations, including installation, authentication, data exfiltration, and content publication, far beyond simple text generation.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

curl ... | sh fetches and executes remote code directly, which is a classic unsafe pattern because it bypasses local review and trusts the remote endpoint at execution time. Even with checksum claims elsewhere in the document, this specific one-liner executes a network-delivered installer immediately and could lead to full compromise of the host environment if the source or delivery path is tampered with.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Quick Start

bash
curl -fsSL https://cli.inference.sh | sh && infsh login

# Research trending LinkedIn content patterns
infsh app run tavily/search-assistant --input '{

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest description lists triggers such as "thought leadership," "professional content," and "b2b content," which are generic phrases that could match many unrelated writing or marketing requests. The file does not provide exclusion conditions or narrower activation scope, increasing the chance of unintended skill invocation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill is described as LinkedIn post writing, but the documentation expands into external search, image generation, and cross-posting to X. This scope drift increases the chance that an agent or user triggers actions beyond expected content drafting, including publishing or transmitting data to third-party services without clear boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The X cross-posting example performs an external publish action but is presented as a casual reference without an explicit warning that it will post to a connected account. In an agent setting, hidden or under-signaled outbound side effects are dangerous because they can cause unauthorized or accidental publication.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.