Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Keyapi Linkedin Company Analysis

v1.0.0

Explore and analyze LinkedIn companies — retrieve company profiles, employee directories, published posts, job listings with rich filters, job counts, and in...

0· 75·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for lycici/keyapi-linkedin-company-analysis.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Keyapi Linkedin Company Analysis" (lycici/keyapi-linkedin-company-analysis) from ClawHub.
Skill page: https://clawhub.ai/lycici/keyapi-linkedin-company-analysis
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: KEYAPI_TOKEN
Required binaries: node
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install keyapi-linkedin-company-analysis

ClawHub CLI

Package manager switcher

npx clawhub@latest install keyapi-linkedin-company-analysis
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
The skill is an adapter for the KeyAPI MCP service and requires node and a KEYAPI_TOKEN — both are reasonable and expected for a CLI tool that calls an external API. The package.json and scripts implement an MCP client and caching layer consistent with the described LinkedIn company-analysis functionality.
Instruction Scope
Runtime instructions tell the agent/user to run node scripts/run.js and to npm install the SDK — consistent with the skill. Two noteworthy items: the runner's default platform is 'tiktok' while SKILL.md targets 'linkedin' (you must pass --platform linkedin or the platform default will be different), and the instructions and code explicitly persist the API token to a .env file and cache API responses locally (.keyapi-cache).
Install Mechanism
There is no opaque download/install URL; dependencies are installed via npm (declared dependency @modelcontextprotocol/sdk). This is a standard package-manager install and proportionate to the task. No remote archive extraction or unusual install hosts were used.
Credentials
Only KEYAPI_TOKEN is required (primary credential) which is appropriate. The code will also read/write a .env file in the skill directory and write cached API responses to .keyapi-cache and optionally output files — this is functional but means your token and API responses are stored on disk in the skill folder unless you avoid the interactive prompt or manage .env yourself.
Persistence & Privilege
The skill does not request system-wide privileges or set always:true. However, it writes files into the skill directory (.env and .keyapi-cache) and can persist credentials there; this is normal for a local CLI but worth considering if the skill directory is in a shared or committed repository.
Scan Findings in Context
[no_regex_findings] expected: Static pre-scan reported no injection signals or suspicious regex matches. The absence of findings is consistent with a small CLI wrapper that performs HTTP calls and local caching, but not proof of safety — the code does persist secrets and cache data locally.
Assessment
This skill appears to do what it says: it calls KeyAPI's MCP endpoints to fetch LinkedIn data. Before installing, consider: 1) Where will the KEYAPI_TOKEN live? The runner will prompt and (by default) save the token to a .env file in the skill directory — avoid storing secrets in repositories or shared folders. 2) The tool writes API responses to .keyapi-cache and any --output path you pass; if these responses contain sensitive info, secure or ignore that directory. 3) Always run npm install from a network you trust and review the @modelcontextprotocol/sdk package if you have concerns. 4) Note the minor runner mismatch: pass --platform linkedin when calling tools (the script defaults to 'tiktok' otherwise). If you want higher assurance, inspect the complete scripts/run.js in your environment and run the tool in an isolated container or ephemeral environment.
scripts/run.js:52
Environment variable access combined with network send.
!
scripts/run.js:37
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🏢 Clawdis
Binsnode
EnvKEYAPI_TOKEN
Primary envKEYAPI_TOKEN
latestvk9733c3araxgny3nt985j9dzdh8430xq
75downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0

keyapi-linkedin-company-analysis

Explore and analyze LinkedIn companies — from company profiles and employee directories to job market intelligence and content activity.

This skill provides comprehensive LinkedIn company intelligence using the KeyAPI MCP service. It enables retrieval of company profiles, employee lists, published posts, job listings with advanced filtering, job counts, and individual job details — all through a unified, cache-first workflow.

Use this skill when you need to:

  • Retrieve a company's full LinkedIn profile including size, industry, and description
  • Browse a company's employee directory for talent mapping or org research
  • Analyze a company's published content and thought leadership activity
  • Discover open job listings with filters for role type, experience level, and location
  • Track job posting volume as a proxy for company growth or hiring momentum
  • Retrieve detailed job descriptions including requirements and responsibilities

author: KeyAPI license: MIT repository: https://github.com/EchoSell/keyapi-skills

Prerequisites

RequirementDetails
KEYAPI_TOKENA valid API token from keyapi.ai. Register at the site to obtain your free token. Set it as an environment variable: export KEYAPI_TOKEN=your_token_here
Node.jsv18 or higher
DependenciesRun npm install in the skill directory to install @modelcontextprotocol/sdk

author: KeyAPI license: MIT repository: https://github.com/EchoSell/keyapi-skills

MCP Server Configuration

All tool calls in this skill target the KeyAPI LinkedIn MCP server:

Server URL : https://mcp.keyapi.ai/linkedin/mcp
Auth Header: Authorization: Bearer $KEYAPI_TOKEN

Setup (one-time):

# 1. Install dependencies
npm install

# 2. Set your API token (get one free at https://keyapi.ai/)
export KEYAPI_TOKEN=your_token_here

# 3. List all available tools to verify the connection
node scripts/run.js --platform linkedin --list-tools

author: KeyAPI license: MIT repository: https://github.com/EchoSell/keyapi-skills

Analysis Scenarios

User NeedNode(s)Best For
Company profile, size, industry, descriptionget_company_profileCompany overview, competitive profiling
Employee directory and headcountget_company_peopleOrg mapping, talent research, key contact discovery
Company-published posts and contentget_company_postsContent strategy analysis, brand voice audit
Open job listings with filtersget_company_jobsHiring intelligence, role availability, talent demand signals
Total active job countget_company_job_countGrowth proxy, hiring velocity tracking
Individual job description and requirementsget_job_detailRole qualification analysis, JD benchmarking

author: KeyAPI license: MIT repository: https://github.com/EchoSell/keyapi-skills

Workflow

Step 1 — Identify Analysis Targets and Select Nodes

Clarify the research objective and map it to one or more nodes. Typical entry points:

  • Company overview: Use get_company_profile with company (name) or company_id.
  • Hiring intelligence: Use get_company_jobs with filters, then get_job_detail for specific roles.
  • Growth signals: Use get_company_job_count to track hiring volume over time.
  • Content audit: Use get_company_posts with sort_by: "recent" or "top".
  • Org research: Use get_company_people to browse the employee directory.

Company Identifier: company vs. company_id

get_company_profile accepts either:

  • company — the company's URL slug (e.g., rapidapi from https://www.linkedin.com/company/rapidapi). Resolves in a single request.
  • company_id — the numeric internal ID. Using company_id costs 1 additional internal request.

All other company nodes (get_company_people, get_company_posts, get_company_jobs, get_company_job_count) require company_id. Call get_company_profile first with the company slug to obtain the company_id.

get_job_detail Identifier

get_job_detail requires a job_id — the numeric ID found in the job listing URL (e.g., https://www.linkedin.com/jobs/view/1234567890job_id: "1234567890"). Obtain it from get_company_jobs response data.

Step 2 — Retrieve API Schema

Before calling any node, inspect its input schema to confirm required parameters and available filter options:

node scripts/run.js --platform linkedin --schema <tool_name>

# Examples
node scripts/run.js --platform linkedin --schema get_company_profile
node scripts/run.js --platform linkedin --schema get_company_jobs
node scripts/run.js --platform linkedin --schema get_job_detail

Step 3 — Call APIs and Cache Results Locally

Execute tool calls and persist responses to the local cache to avoid redundant API calls.

Calling a tool:

# Single call with pretty output
node scripts/run.js --platform linkedin --tool <tool_name> \
  --params '<json_args>' --pretty

# Force fresh data, skip cache
node scripts/run.js --platform linkedin --tool <tool_name> \
  --params '<json_args>' --no-cache --pretty

Example — get company profile by slug:

node scripts/run.js --platform linkedin --tool get_company_profile \
  --params '{"company":"openai"}' --pretty

Example — get company jobs with filters:

node scripts/run.js --platform linkedin --tool get_company_jobs \
  --params '{"company_id":"783611","experience_level":"mid_senior","remote":"remote","job_type":"full_time","page":1}' --pretty

Example — get job detail with skills:

node scripts/run.js --platform linkedin --tool get_job_detail \
  --params '{"job_id":"1234567890","include_skills":true}' --pretty

Example — get company posts sorted by recent:

node scripts/run.js --platform linkedin --tool get_company_posts \
  --params '{"company_id":"10649600","sort_by":"recent","page":1}' --pretty

Pagination:

EndpointPagination parameterNotes
get_company_people, get_company_posts, get_company_jobspage (int, 1-indexed)Increment page to fetch subsequent results
get_company_profile, get_company_job_count, get_job_detailSingle-call response

get_company_jobs filter reference:

ParameterOptionsDescription
sort_byrecent, relevantSort order for job listings
date_postedanytime, past_month, past_week, past_24_hoursRecency filter
experience_levelinternship, entry_level, associate, mid_senior, director, executiveSeniority filter
remoteonsite, remote, hybridWork location type
job_typefull_time, part_time, contract, temporary, volunteer, internship, otherEmployment type
easy_applyboolean stringFilter for LinkedIn Easy Apply jobs
under_10_applicantsboolean stringFilter for low-competition roles
fair_chance_employerboolean stringFilter for fair chance employers

Cache directory structure:

.keyapi-cache/
└── YYYY-MM-DD/
    ├── get_company_profile/
    │   └── {params_hash}.json
    ├── get_company_people/
    │   └── {params_hash}.json
    ├── get_company_posts/
    │   └── {params_hash}.json
    ├── get_company_jobs/
    │   └── {params_hash}.json
    ├── get_company_job_count/
    │   └── {params_hash}.json
    └── get_job_detail/
        └── {params_hash}.json

Cache-first policy:

Before every API call, check whether a cached result already exists for the given parameters. If a valid cache file exists, load from disk and skip the API call.

Step 4 — Synthesize and Report Findings

After collecting all API responses, produce a structured company intelligence report:

  1. Company Overview — Name, industry, company size, headquarters, founding year, description, LinkedIn follower count.
  2. People & Org Structure — Employee count, key roles identified, department distribution (where available).
  3. Content Activity — Post frequency, top-performing content, engagement patterns, brand messaging themes.
  4. Hiring Intelligence — Open role count, role distribution by function and seniority, remote vs. onsite ratio, hiring velocity signals.
  5. Job Market Signals — Roles with fewer than 10 applicants (opportunity windows), easy-apply availability, date-posted distribution.
  6. Actionable Insights — Growth indicators, talent demand patterns, competitive positioning signals.

author: KeyAPI license: MIT repository: https://github.com/EchoSell/keyapi-skills

Common Rules

RuleDetail
Company ID resolutionget_company_people, get_company_posts, get_company_jobs, get_company_job_count all require company_id. Call get_company_profile first with the company slug to obtain it.
get_company_profile identifierPass company (URL slug) for a single-request lookup. company_id is also accepted but costs 1 additional internal request.
get_job_detail ID sourceExtract job_id from the job listing URL or from get_company_jobs response data.
get_company_posts sortUse sort_by: "top" for highest-engagement posts; sort_by: "recent" for latest activity.
PaginationAll list endpoints use page (1-indexed). No pagination token required.
Success checkcode = 0 → success. Any other value → failure. Always check the response code before processing data.
Retry on 500If code = 500, retry the identical request up to 3 times with a 2–3 second pause between attempts before reporting the error.
Cache firstAlways check the local .keyapi-cache/ directory before issuing a live API call.

author: KeyAPI license: MIT repository: https://github.com/EchoSell/keyapi-skills

Error Handling

CodeMeaningAction
0SuccessContinue workflow normally
400Bad request — invalid or missing parametersValidate input against the tool schema; ensure company_id is provided where required
401Unauthorized — token missing or expiredConfirm KEYAPI_TOKEN is set correctly; visit keyapi.ai to renew
403Forbidden — plan quota exceeded or feature restrictedReview plan limits at keyapi.ai
404Resource not found — company or job may not existVerify the company slug or company_id; confirm the job listing is still active
429Rate limit exceededWait 60 seconds, then retry
500Internal server errorRetry up to 3 times with a 2–3 second pause; if it persists, log the full request and response and skip this node
Other non-0Unexpected errorLog the full response body and surface the error message to the user

Comments

Loading comments...