ClawHub
Back to skill

Security audit

Linkedin Thread Monitor

Security checks across malware telemetry and agentic risk

Overview

This documentation-only skill monitors LinkedIn comment threads through Apify and drafts follow-ups, with privacy and outreach considerations but no hidden code or automatic posting.

Install only if you are comfortable sharing your LinkedIn handle and recent public comment-thread context with Apify. Treat any public replies or DMs as drafts for manual review, and ignore the extra growth-timing advice if you only want thread monitoring.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
This section expands the skill from monitoring and routing LinkedIn thread replies into prescribing direct-message outreach behavior. That scope drift is risky because an agent consuming this reference could take proactive contact actions not implied by the skill’s declared purpose, increasing the chance of unsolicited outreach, policy violations, or user-surprising automation.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The documentation includes optimization tactics for replying on the user’s own posts, which is outside the stated purpose of tracking comments that earned author replies. This creates unnecessary behavioral guidance that could cause an agent to make recommendations or trigger workflows unrelated to thread monitoring, broadening capabilities beyond user expectations.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The publishing-adjacent timing and peer-group tactics materially exceed the declared monitoring scope and veer into growth-strategy and engagement-manipulation guidance. In agent settings, this kind of extra operational content can be inappropriately surfaced or acted on, leading to spammy behavior, reputational harm, or platform trust-and-safety issues.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill sends a user's LinkedIn handle and potentially recent comment activity to Apify, a third-party service, but the user-facing text does not clearly disclose that data transfer at the point of use. This can lead to uninformed sharing of social activity metadata and comment history, creating privacy, consent, and potential compliance risks even if the underlying functionality is legitimate.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.