ClawHub
Back to skill

Security audit

linkedin-search

Security checks for vulnerabilities and agentic risk

Overview

The skill is a LinkedIn candidate-search helper, but its setup asks users to copy sensitive Chrome profile data into a persistent debug profile.

Review this carefully before installing. Use only a fresh dedicated Chrome profile for LinkedIn, log in manually there, bind debugging to localhost, avoid copying your normal Chrome Cookies or Login Data, and delete any temporary profile after use. Expect LinkedIn profile data to be saved under ./linkedin-save/.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
skill.md:129
Finding

Sensitive Chrome Authentication Data Copied to a Predictable Temporary Directory

Content
View full analysis

Vulnerability Details

File Location: skill.md, lines 129–140
Vulnerability Type: Insecure temporary storage of sensitive browser data
Risk Level: High

Vulnerable Code

bash
pkill -9 -f "Google Chrome"

mkdir -p /tmp/chrome_debug_profile
cp -r ~/Library/Application\ Support/Google/Chrome/Default/{Cookies,"Login Data","Web Data",Preferences,"Local State"} \
  /tmp/chrome_debug_profile/ 2>/dev/null

nohup "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" \
  --remote-debugging-port=9222 \
  --user-data-dir="/tmp/chrome_debug_profile" \
  --no-first-run --disable-sync \
  > /tmp/chrome_debug.log 2>&1 &

Technical Analysis

The setup procedure copies Chrome's Cookies, Login Data, Web Data, Preferences, and Local State files into the fixed path /tmp/chrome_debug_profile. These files can contain authenticated session material, saved-login metadata, autofill information, and cryptographic state associated with browser-stored secrets.

The procedure does not:

  • Create the destination with restrictive permissions such as mode 0700.
  • Use an unpredictable, securely created temporary directory.
  • Verify ownership or reject an existing symbolic link or attacker-controlled directory.
  • Delete the copied profile after the skill finishes.
  • Limit the copied data to the LinkedIn session needed for the task.

Because mkdir -p accepts an existing path, a local attacker may prepare the destination or manipulate its contents before the user runs these commands. The predictable path also makes the copied browser data straightforward to locate.

The browser is additionally launched with Chrome DevTools remote debugging on port 9222. The command does not explicitly bind the debugging endpoint to loopback. Any process able to reach that endpoint may be able to inspect pages, execute JavaScript in authenticated contexts, navigate the browser, and extract displayed data.

Finally, pkill -9 -f "Google Chrome" forcibly termin ...[truncated 1716 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not copy the user's default Chrome profile data. Create a dedicated browser profile for this skill and require the user to log in to LinkedIn manually:

    bash
    profile_dir="$(mktemp -d "${TMPDIR:-/tmp}/linkedin-chrome.XXXXXX")"
chmod 700 "$profile_dir"

"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" \
  --remote-debugging-address=127.0.0.1 \
  --remote-debugging-port=9222 \
  --user-data-dir="$profile_dir" \
  --no-first-run \
  --disable-sync

  2. Never copy Cookies, Login Data, Web Data, or Local State from a general-purpose browser profile. This exceeds the minimum data access required for candidate searching.

  3. Bind DevTools explicitly to loopback with --remote-debugging-address=127.0.0.1. Where supported, use a randomized port or authenticated transport and ensure host firewall rules prevent non-local access.

  4. Use secure temporary-directory creation. Create the directory with mktemp -d, enforce mode 0700, verify ownership, and avoid following pre-existing links.

  5. Implement cleanup. Close only the dedicated Chrome process and remove the temporary profile at the end of the run. Clearly warn the user that cleanup removes that profile's browser state.

  6. Avoid broad process termination. Replace pkill -9 -f "Google Chrome" with process tracking for the dedicated browser instance. Attempt graceful termination before considering a forced kill.

  7. Minimize retained personal data. Store only candidate information necessary for deduplication and evaluation, apply restrictive permissions to linkedin-save, and document retention and deletion procedures.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
83% confidence
Finding

The skill requires a Chrome remote debugging session attached to a logged-in LinkedIn browser profile, which weakens normal browser isolation and gives the automation broad access to authenticated content. In context, this is more dangerous because the same skill also instructs the operator to reuse a real user session, enabling large-scale account actions and data access through an exposed debug channel.

Content

Scanner excerpt · skill.md (reported line 118)May include surrounding context.

md
### Condition 1: Chrome Debug Session is Running

Chrome must be running in remote debug mode on **port 9222**, using a user profile with an active LinkedIn session.

**Verification:** Call `mcp__chrome-devtools__list_pages`. If it returns a page list, pass.

Credential Access

High
Category
Privilege Escalation
Confidence
99% confidence
Finding

The skill instructs copying Chrome credential-related artifacts including Cookies, Login Data, Web Data, Preferences, and Local State into a separate profile for reuse. This is classic credential/session theft behavior: it duplicates authentication material so the automated process can impersonate the user on LinkedIn and potentially other sites available in that profile.

Content

Scanner excerpt · skill.md (reported line 133)May include surrounding context.

md
2. Copy your login profile (first time only):
   mkdir -p /tmp/chrome_debug_profile
   cp -r ~/Library/Application\ Support/Google/Chrome/Default/{Cookies,"Login Data","Web Data",Preferences,"Local State"} \
     /tmp/chrome_debug_profile/ 2>/dev/null

3. Launch Chrome in debug mode:

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
100% confidence
Finding

The matched content aligns with info-stealer tradecraft because it explicitly copies Chrome's Cookies and Login Data from the default profile to another directory, preserving authenticated state for automated access. In this skill's context, that behavior is not incidental; it is operationally central to scraping authenticated LinkedIn data, making the pattern especially dangerous and strongly indicative of credential harvesting or session theft.

Content

Scanner excerpt · skill.md (reported line 133)May include surrounding context.

Verification: Call mcp__chrome-devtools__list_pages. If it returns a page list, pass.

If not met:

text
❌ Chrome debug session not ready

Run the following steps in your terminal:

1. Close all Chrome windows (or force-quit):
   pkill -9 -f "Google Chrome"

2. Copy your login profile (first time only):
   mkdir -p /tmp/chrome_debug_profile
   cp -r ~/Library/Application\ Support/Google/Chrome/Default/{Cookies,"Login Data","Web Data",Preferences,"Local State"} \
     /tmp/chrome_debug_profile/ 2>/dev/null

3. Launch Chrome in debug mode:
   nohup "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" \
     --remote-debugging-port=9222 \
     --user-data-dir="/tmp/chrome_debug_profile" \
     --no-first-run --disable-sync \
     > /tmp/chrome_debug.log 2>&1 &

4. Wait 3 seconds, then re-run /linkedin-search

Condition 2: LinkedIn is Logged In

The browser must have an active LinkedIn session (used to access profiles and internal search).

Verification: Nav

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly states that it saves LinkedIn profiles to local markdown files, but the description does not clearly warn users that scraped personal profile data will be persisted on disk. This creates a privacy and consent risk because operators may invoke the skill without understanding that profile URLs, names, locations, and inferred employment details will be stored locally for later reuse.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
87% confidence
Finding

Launching Chrome with nohup and a persistent user-data-dir creates a long-lived automated session that can continue to hold valid LinkedIn authentication state after the user stops actively supervising it. This increases exposure to session hijacking, unauthorized reuse, and unintended scraping if the debug-enabled browser remains running.

Content

Scanner excerpt · skill.md (reported line 137)May include surrounding context.

md
/tmp/chrome_debug_profile/ 2>/dev/null

3. Launch Chrome in debug mode:
   nohup "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" \
     --remote-debugging-port=9222 \
     --user-data-dir="/tmp/chrome_debug_profile" \
     --no-first-run --disable-sync \

Static analysis

No suspicious patterns detected.