Linkedin - automation

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:01 AM UTC
• Version: 1.0.1

Overview

This LinkedIn automation skill appears purpose-related, but it can act on a real public account and includes under-scoped automatic posting and persistent service behavior.

Review this carefully before installing. Use it only with a LinkedIn account where you accept automation risk, disable or avoid the cron/webhook auto-posting service unless you have explicit safeguards, and require manual review before any post, repost, edit, or delete action. Prefer a dedicated browser profile and do not run the persistent service with elevated privileges unless you understand how to stop and audit it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tainted flow: 'STATE_FILE' from os.environ.get (line 9, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

def _save_state(state):
    os.makedirs(os.path.dirname(STATE_FILE), exist_ok=True)
    with open(STATE_FILE, "w") as f:
        json.dump(state, f, ensure_ascii=False, indent=2)

• Confidence: 95% confidence
• Finding: The state file path is taken directly from the LINKEDIN_LIKES_STATE environment variable and then used for directory creation and file writing without validation. If an attacker can influence the process environment, they can redirect writes to unintended filesystem locations, potentially overwriting user files or planting data in sensitive paths with the privileges of the running agent.

Tainted flow: 'STYLE_FILE' from os.environ.get (line 9, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

def _save_style(style):
    os.makedirs(os.path.dirname(STYLE_FILE) if os.path.dirname(STYLE_FILE) else ".", exist_ok=True)
    with open(STYLE_FILE, "w") as f:
        json.dump(style, f, ensure_ascii=False, indent=2)

• Confidence: 92% confidence
• Finding: The code writes to a path taken directly from the LINKEDIN_STYLE_FILE environment variable without validation or restriction. If an attacker or untrusted wrapper controls the environment, they can redirect writes to arbitrary files accessible by the running user, causing unintended overwrite, data corruption, or placement of harvested profile data in sensitive locations.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documentation describes environment-variable use and local file writes but does not declare permissions, which weakens user awareness and any permission-gating the platform may rely on. In a skill that automates a logged-in social account and persists browser/session-related state, undeclared file and env access increases the risk of hidden persistence, data leakage, or unexpected side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose is LinkedIn automation, but the documented behavior extends to running an HTTP server, mutating local records via webhook endpoints, persisting style profiles, and managing additional state files. That mismatch is dangerous because users may authorize the skill expecting browser automation only, while it also exposes network-reachable control surfaces and broader local data handling that can be abused for unauthorized posting or data manipulation.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The documentation claims personal-use-only and warns against scraping, yet it explicitly offers an 'activity' command to scrape another user's activity. This inconsistency normalizes prohibited collection behavior and can lead to privacy violations, account restrictions, or misuse of harvested engagement data.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The skill states a strict rule to never post or modify content without explicit approval, but later documents automatic edit application and cron-based auto-posting. In the context of a persistent logged-in LinkedIn session, that contradiction is especially dangerous because queued or remotely triggered actions can publish or alter content without real-time user confirmation.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: Telling agents to use the skill for 'any LinkedIn task' creates an overly broad activation trigger that can cause the skill to be invoked in contexts beyond what the user intended. Because this skill can post, edit, delete, scrape activity, and run scheduled workflows against a real account, over-broad invocation increases the chance of unintended high-impact actions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The section describing auto-posting via cron/webhook does not foreground the autonomous nature and risk of publishing from a persistent authenticated session. In this context, insufficient warning makes accidental deployment more likely and can lead to unreviewed public posts, reputational damage, or abuse through exposed workflow endpoints.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document describes fully automated posting to an external platform once a scheduled time passes, and also includes privileged installation steps using sudo/systemd, but it does not present explicit safety warnings, authorization requirements, or operator confirmation expectations. In a skill that automates LinkedIn actions with a persistent browser profile, this increases the risk of unintended account activity, policy-violating automation, or unsafe deployment changes by users who may treat the instructions as turnkey.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill collects a user's recent LinkedIn posts and comments, derives a behavioral/style profile, and persists both summary fields and content samples to local disk without any visible consent, notice, retention control, or minimization in this file. In the context of a LinkedIn automation skill using a persistent browser profile, this increases privacy risk because personal content and inferred traits are silently stored and may later be reused or exposed.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The CLI exposes destructive actions such as deleting and editing comments, reposting, and posting content with no confirmation gate, dry-run mode, or user-visible warning. In an automation skill using a persistent authenticated LinkedIn session, a mistaken invocation, prompt-injection-driven tool call, or misuse by another component can immediately perform irreversible or reputation-impacting actions on the user's account.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

playwright>=1.40.0

• Confidence: 92% confidence
• Finding: The dependency is specified with a lower-bound constraint only, which allows installation of any newer Playwright release, including future major versions with breaking changes or newly introduced malicious or vulnerable transitive content. In an automation skill that uses a persistent browser profile and interacts with LinkedIn, uncontrolled dependency drift increases supply-chain risk and can cause unexpected behavior in a high-privilege browser automation context.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.