Security audit

Linkedin - automation

Security checks for vulnerabilities and agentic risk

Overview

This LinkedIn automation skill is mostly coherent, but it can affect a real public account and has under-scoped automation, persistence, and webhook security risks that need review before use.

Review this carefully before installing. Use a dedicated LinkedIn browser profile, avoid exposing or installing the webhook as a system service until authentication and least-privilege service configuration are added, remove --no-sandbox, require explicit confirmation for public or destructive actions, and add LinkedIn-only URL validation and local file permission controls.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/cc-webhook.py:26
Finding: Unauthenticated Webhook Permits Unauthorized Content Modification and Approval
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: references/content-calendar.md:75
Finding: Privileged Persistent Service Installation Exceeds Minimum Required Privileges
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/lib/actions.py:135
Finding: Arbitrary URLs Are Opened in a Persistent Authenticated Browser Context
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/lib/browser.py:23
Finding: Chromium Sandbox Is Explicitly Disabled While Processing Remote Content
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/lib/style_learner.py:9
Finding: Personal LinkedIn Writing Samples Are Persisted Without Explicit Owner-Only Permissions
Content: View full analysis
0.3 else "moderate" if emoji_density > 0.1 else "minimal", "tone": "casual" if casual_markers > 3 or exclamation_count > len(all_content) else "professional" if casual_markers == 0 else "professional-friendly", "uses_hashtags": len(all_hashtags) > 0, "top_hashtags": list(dict.fromkeys(all_hashtags))[:10], "sample_posts": [p[:300] for p in posts[:5]], "sample_comments": [c[:200] for c in comments_raw[:3]], } _save_style(style) ``` ### Technical Analysis The style profile contains the user's display name, profile slug, behavioral characteristics, and verbatim excerpts from posts and comments. It is written using the process's default umask, with no explicit owner-only permission enforcement. On systems with a permissive umask, shared home directory, weak backup controls, or multiple local users, this may expose personal content. The implementation also stores raw writing samples even though many style attributes could be retained without preserving verbatim content. ### Attack Path 1. The user runs `learn-profile`. 2. The Skill writes `~/.linkedin-style.json`. 3. The resulting file mode is determined by the ...[truncated 640 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/requirements.txt:1
Finding: Playwright Dependency Uses an Unbounded Version Range
Content: View full analysis
=1.40.0 ``` ### Technical Analysis The dependency specification accepts every Playwright release from version 1.40.0 onward. Installation results can therefore change over time without a corresponding project change or security review. The documented setup also runs `playwright install chromium`, which retrieves a browser artifact associated with the selected Playwright version. Because neither the Python package nor browser version is locked by this project, future builds are not reproducible. No dependency confusion, typosquatting, malicious package source, or known vulnerable Playwright version was identified. The risk is the unrestricted future-version range and absence of integrity locking. ### Attack Path 1. The user installs dependencies at a later date. 2. The package resolver selects the newest release satisfying `>=1.40.0`. 3. The installation pulls Python package code and the corresponding Chromium artifact that were not reviewed with this Skill version. 4. A compromised, malicious, or incompatible future release executes with the user's privileges when the Skill imports or launches it. ### Impact Assessment A compromised dependency or browser artifact could potentially access: - The persistent LinkedIn browser profile. - Local files available to the Skill process. - LinkedIn content and authenticated actions. - Calendar and style-monitor state. This is a supply-chain hardening weakness rather than evidence that the current Playwright package is malicious. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (35)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill adds behavior for learning and persisting a user's writing profile from their posts and comments, but this data collection and local storage is not clearly surfaced in the top-level declared purpose. Hidden or under-disclosed profiling increases privacy risk because users may not realize the skill is creating a persistent behavioral profile that could expose language patterns, topics, or other sensitive personal traits.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill adds behavior for learning and persisting a user's writing profile from their posts and comments, but this data collection and local storage is not clearly surfaced in the top-level declared purpose. Hidden or under-disclosed profiling increases privacy risk because users may not realize the skill is creating a persistent behavioral profile that could expose language patterns, topics, or other sensitive personal traits.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill adds behavior for learning and persisting a user's writing profile from their posts and comments, but this data collection and local storage is not clearly surfaced in the top-level declared purpose. Hidden or under-disclosed profiling increases privacy risk because users may not realize the skill is creating a persistent behavioral profile that could expose language patterns, topics, or other sensitive personal traits.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill adds behavior for learning and persisting a user's writing profile from their posts and comments, but this data collection and local storage is not clearly surfaced in the top-level declared purpose. Hidden or under-disclosed profiling increases privacy risk because users may not realize the skill is creating a persistent behavioral profile that could expose language patterns, topics, or other sensitive personal traits.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 84% confidence
Finding: The skill adds behavior for learning and persisting a user's writing profile from their posts and comments, but this data collection and local storage is not clearly surfaced in the top-level declared purpose. Hidden or under-disclosed profiling increases privacy risk because users may not realize the skill is creating a persistent behavioral profile that could expose language patterns, topics, or other sensitive personal traits.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description says to use the skill for 'any LinkedIn task,' which is an overly broad trigger for a high-risk automation capability. Broad invocation language can cause the agent to route unrelated or sensitive requests into a skill that can post, edit, delete, scrape, and auto-publish, increasing the chance of inappropriate automation or abuse.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation explicitly says not to scrape other users' data, yet it advertises an activity command for scraping someone else's profile activity. This contradiction is dangerous because it normalizes prohibited behavior while giving users a misleading sense that the skill is policy-compliant, increasing the chance of privacy violations, account restrictions, and intentional misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The function performs irreversible comment deletion based only on a text fragment match and immediately confirms the delete flow, with no user confirmation, preview, or strong verification that the targeted comment is the intended one. In a LinkedIn automation context, this increases the chance of accidental or automated deletion of the wrong content, causing reputational damage, loss of records, and abuse if invoked by an untrusted workflow or prompt chain.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: find_menu_option searches broad element types by text and clicks the first textual match, including potentially destructive options such as delete. In this skill context, that can trigger irreversible account actions like deleting comments or operating on the wrong target when DOM structure, language, or surrounding menu content differs from expectations.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill documents behaviors that imply access to environment variables and local file writes, but it does not declare any explicit tool scope or allowed-tools boundary. In an automation skill that uses persistent browser profiles, local state files, debug screenshots, and webhook configuration, missing scope declarations weakens least-privilege controls and can enable broader-than-expected access to sensitive local data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill is framed as personal-account productivity automation, but it also exposes a command to scrape another person's activity. That expands the skill from self-management into third-party data collection, raising privacy, platform-policy, and abuse risk, especially when combined with browser automation and persistent sessions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The content calendar section describes webhook-driven approval handling and automatic posting via cron, but it does not place a prominent warning at that location about autonomous public actions. In a skill that can publish on a real LinkedIn account, understated warnings around auto-posting increase the risk of accidental or premature posting, especially if webhook inputs or schedule state are wrong.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file describes automatically publishing LinkedIn posts once scheduled time has passed and installing a webhook as a systemd service, both of which can affect external accounts and system state. The document explains how the workflow works, but it does not include an explicit warning about unintended posting, account impact, or changes to the host system.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/content-calendar.md (reported line 77)May include surrounding context.
bash
# Install as systemd service sudo cp cc-webhook.service /etc/systemd/system/ sudo systemctl enable --now cc-webhook # Nginx proxy (optional)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/content-calendar.md (reported line 78)May include surrounding context.
bash
# Install as systemd service sudo cp cc-webhook.service /etc/systemd/system/ sudo systemctl enable --now cc-webhook # Nginx proxy (optional)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/content-calendar.md (reported line 78)May include surrounding context.
bash
# Install as systemd service sudo cp cc-webhook.service /etc/systemd/system/ sudo systemctl enable --now cc-webhook # Nginx proxy (optional) location /api/actions {

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file documents DOM targets for comment menus, delete/edit menu items, and confirmation dialogs, including "Löschen/Delete/Ja" buttons. Because markdown files should warn about behaviors that could affect user data or system integrity, the absence of any warning about destructive actions creates a missing-user-warning issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The webhook accepts unauthenticated POST and PUT requests and directly appends to action logs and modifies cc-data.json, including post text and status, with permissive CORS enabled. In the context of a LinkedIn automation/content approval workflow, this allows unauthorized parties or malicious web pages to alter publishing decisions, inject or rewrite content, and trigger downstream automation without any approval enforcement.
Content: No source excerpt is available for this finding.

Tainted flow: 'WAKE_FILE' from os.environ.get (line 11, credential/environment) → open (file write)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · scripts/cc-webhook.py (reported line 103)May include surrounding context.
python
'timestamp': data.get('timestamp', datetime.now().isoformat()) }) try: with open(WAKE_FILE, 'w') as wf: json.dump({ 'type': 'edit', 'postId': post_id, 'note': note, 'timestamp': datetime.now().isoformat()

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The helper saves screenshots of the live LinkedIn page to /tmp on failures, which can capture sensitive page contents such as account data, private messages, comments, feeds, or draft content without any explicit disclosure or retention controls. In a browser automation skill using a persistent logged-in profile, these artifacts can expose user data to other local users, processes, or later forensic collection if the files are not promptly removed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code navigates a logged-in LinkedIn session, extracts post text and engagement metrics, and returns the collected data, but the implementation provides no confirmation prompt, print/log notice, or warning comment/docstring that clearly discloses the scope of data collection. Because it accesses and processes account-specific activity data from an authenticated session, a user-visible warning would improve transparency.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The function opens the LinkedIn dashboard and extracts profile views, impressions, search appearances, and follower counts, which are account-specific analytics data. While the docstring states the function purpose, there is no visible confirmation prompt or user-facing notice in the code indicating that authenticated profile statistics will be read from the account session.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file sets LOCALE = "de-DE", which forces a specific language/locale for all browser sessions. Under the policy, locale restrictions should either be user-selectable or clearly justified as region-specific; neither is present here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This function programmatically reads a user's LinkedIn feed and returns post author names, post text, and URLs without any built-in notice, consent check, or data-minimization guardrail. Because feed contents can include personal data, sensitive business information, or private contextual signals, silent collection and downstream exposure increase privacy and compliance risk, especially in an automation skill designed for broad LinkedIn tasks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code persistently stores LinkedIn activity-derived data (seen_likes and timestamps) to a local file with no disclosure, consent, retention control, or access protection. In the context of a LinkedIn automation skill that tracks engagement, this creates privacy and compliance risk because user behavioral data is silently retained and may be readable by other local users or processes.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.