linkedin-candidate-search

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:23 AM UTC
• Version: 1.0.0

Overview

This LinkedIn search skill is purpose-aligned in broad terms, but it asks users to duplicate browser credential/session files and expose them through a persistent Chrome debugging session.

Review before installing. This skill may help automate LinkedIn candidate searches, but you should not copy your normal Chrome Cookies, Login Data, or other profile stores into a temporary debugging profile. Use a dedicated browser profile, log in manually only for the intended account, restrict DevTools access, close the debugging browser when done, and delete any temporary profile and saved candidate data you no longer need.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: skill.md:63

Finding

Browser credential and session data copied into a predictable temporary directory

Content

View full analysis

/dev/null ``` ### Technical Analysis The Skill instructs users to copy Chrome's `Cookies`, `Login Data`, `Web Data`, `Preferences`, and `Local State` files into the fixed path `/tmp/chrome_debug_profile`. These files may contain or facilitate access to: - Authenticated browser cookies and session tokens - Saved-login records - Autofill and other browser data unrelated to LinkedIn - Encryption metadata associated with stored browser secrets - Sensitive browser preferences and account state The Skill only requires an authenticated LinkedIn session. Copying entire credential and browser-data stores therefore exceeds data minimization and least-privilege requirements. The destination is a predictable temporary path. The instructions do not establish restrictive permissions, verify directory ownership, reject symbolic links, or remove the copied data after the operation. Suppressing errors with `2>/dev/null` also makes ownership, permission, and copy failures less visible. ### Attack Path 1. A user follows the Skill's setup instructions. 2. Chrome credential and session files are copied into `/tmp/chrome_debug_profile`. 3. An attacker with sufficient local access anticipates the fixed path and reads the copied data, or prepares a malicious directory or symbolic-link arrangement where platform permissions allow it. 4. The attacker extracts sensitive browser information or uses the copied profile through Chrome. 5. The data remains available after the Skill finishes because no cleanup procedure is specified. Successful exploitation depends on the attacker's local filesyst ...[truncated 553 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: skill.md:68

Finding

Authenticated Chrome profile exposed through a remote debugging endpoint

Content

View full analysis

/tmp/chrome_debug.log 2>&1 & ``` ### Technical Analysis The Skill launches Chrome with remote debugging enabled on port `9222` while using a profile populated with authenticated browser state. A DevTools client connected to this endpoint can perform privileged browser operations, including: - Navigating authenticated pages - Reading rendered page content - Executing JavaScript in page contexts - Inspecting requests and browser state exposed through the debugging protocol The instructions do not explicitly bind the endpoint to loopback, verify which process owns the port before use, restrict access with host firewall rules, or terminate the debugging browser after the task. They also combine the debugging interface with a profile copied from the user's normal Chrome environment, increasing the sensitivity of the exposed session. Remote accessibility depends on Chrome's version, default binding behavior, host networking, and firewall configuration. Even when restricted to loopback, another process running in the user's local environment may attempt to connect to the debugging endpoint. ### Attack Path 1. The user copies authenticated Chrome profile data into `/tmp/chrome_debug_profile`. 2. Chrome starts with the DevTools debugging protocol enabled on port `9222`. 3. An unauthorized process that can reach the endpoint discovers or directly connects to the debugging port. 4. The process enumerates available browser targets. 5. It attaches to an authenticated page or opens a new page under the copied profile. 6. It executes browser actions or extracts information availa ...[truncated 816 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill instructs copying Chrome profile artifacts including Cookies and Login Data into a separate debug profile, which exposes active session material and credential-related browser data to automation. In the context of a LinkedIn scraping skill, this is especially dangerous because it operationalizes reuse of authenticated state for automated access and increases the risk of credential theft, session hijacking, and unauthorized account use.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The instructions explicitly direct reuse of an existing Chrome profile containing LinkedIn session data and login artifacts for automated browsing. This facilitates automated actions under a real authenticated identity and materially increases the risk of account compromise, session theft, and misuse of stored authentication data.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The direct reference to copying Chrome Cookies and Login Data matches credential-access behavior because those files can contain session tokens and sensitive authentication material. Even if framed as setup, the behavior is functionally similar to credential harvesting or reuse, and in this context it enables access to LinkedIn through duplicated authenticated state.

Content

Scanner excerpt · skill.md (reported line 64)May include surrounding context.

md

2. 复制登录态配置文件（首次使用时执行）：
   mkdir -p /tmp/chrome_debug_profile
   cp -r ~/Library/Application\ Support/Google/Chrome/Default/{Cookies,"Login Data","Web Data",Preferences,"Local State"} \
     /tmp/chrome_debug_profile/ 2>/dev/null

3. 以调试模式启动 Chrome：

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 98% confidence

Finding

The skill contains a classic information-stealer pattern by instructing copying of browser Cookies and Login Data from a real user profile into another location for automated reuse. In a skill whose purpose is authenticated LinkedIn scraping, this pattern is more dangerous because it directly operationalizes theft or repurposing of sensitive browser secrets for continued access.

Content

Scanner excerpt · skill.md (reported line 64)May include surrounding context.

-devtools__list_pages`，若返回页面列表则通过。

不满足时的提示：

text

❌ Chrome 调试会话未就绪

请在终端执行以下步骤：

1. 关闭当前所有 Chrome 窗口（或强制退出）：
   pkill -9 -f "Google Chrome"

2. 复制登录态配置文件（首次使用时执行）：
   mkdir -p /tmp/chrome_debug_profile
   cp -r ~/Library/Application\ Support/Google/Chrome/Default/{Cookies,"Login Data","Web Data",Preferences,"Local State"} \
     /tmp/chrome_debug_profile/ 2>/dev/null

3. 以调试模式启动 Chrome：
   nohup "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" \
     --remote-debugging-port=9222 \
     --user-data-dir="/tmp/chrome_debug_profile" \
     --no-first-run --disable-sync \
     > /tmp/chrome_debug.log 2>&1 &

4. 等待 3 秒后重新执行 /linkedin-search

条件二：LinkedIn 已登录

浏览器中必须有已登录 LinkedIn 的会话（用于访问个人档案和内部搜索）。

验证方法：

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is designed to automatically collect and save LinkedIn profile data to local files without any user-facing notice about handling personal data, retention, consent, or access controls. While less severe than credential reuse, this creates privacy and compliance risk because the agent is instructed to store third-party personal information by default.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

Launching Chrome with nohup, remote debugging, and a persistent user-data-dir creates a long-lived authenticated automation environment, which can retain sensitive session state beyond the intended workflow. This persistence expands the attack window if the machine or temp profile is accessed by another process or user.

Content

Scanner excerpt · skill.md (reported line 68)May include surrounding context.

md

/tmp/chrome_debug_profile/ 2>/dev/null

3. 以调试模式启动 Chrome：
   nohup "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" \
     --remote-debugging-port=9222 \
     --user-data-dir="/tmp/chrome_debug_profile" \
     --no-first-run --disable-sync \

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The example and surrounding instructions present required runtime decomposition/output in Chinese-only form, while the skill itself is not clearly limited to a Chinese-only audience or region-specific compliance context. This can violate language-choice policy when a skill effectively forces one language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.