Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

LinkedIn Bulk Connect

v1.1.0

Send LinkedIn connection requests to a list of people via browser automation and track status in a CSV/TSV file. Use when the user wants to bulk-connect with a list of people on LinkedIn (founders, speakers, leads, etc.) from a spreadsheet or list containing LinkedIn profile URLs. Handles Connect button, Follow-mode profiles, already-connected detection, stale URL fallback via LinkedIn search and Google search, and incremental status tracking.

1· 1.1k·0 current·0 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
The name/description match the runtime instructions: the SKILL.md and reference file give step-by-step browser automation to open profiles, click Connect/Invite, and write per-profile status into a CSV/TSV. There are minor mismatches: the README includes a short Python snippet for adding a column but the skill declares no required binaries or runtime — this is a small documentation gap (not a functional contradiction).
Instruction Scope
The instructions explicitly direct the agent to control the user's browser (navigate, click, take snapshots) and to read/write the user's TSV/CSV file. That is expected for this purpose, but it means page snapshots will capture profile content and the agent will act using the user's authenticated LinkedIn session. The workflow also instructs performing Google searches from the LinkedIn tab and repeatedly visiting the feed to evade LinkedIn detection — these are operational choices that have privacy and account-safety implications but are within the skill's stated scope.
Install Mechanism
This is an instruction-only skill with no install spec and no downloaded code; that is the lowest install risk. It does require the user to install/enable an OpenClaw Browser Relay Chrome extension for one recommended mode, which is a separate trust decision outside the skill bundle.
Credentials
The skill requests no environment variables or external credentials, which is proportionate. However, it relies on an already-authenticated browser tab (cookies/session) and optionally an extension (Browser Relay) that has access to browsing context — effectively the skill will act with your LinkedIn account privileges. This is expected for a browser-automation connector but is an important privacy/credential consideration.
Persistence & Privilege
The skill is not always-enabled and does not request system-wide persistence or modify other skills' configurations. It runs only when invoked and uses the browser tooling invoked during the session.
Assessment
Before installing/using: (1) Understand this will act using your logged-in LinkedIn session (no explicit API key is required) — the browser-relay extension or OpenClaw-managed browser must be trusted because it can access your pages and cookies. (2) Automating connection requests can trigger LinkedIn detection and may violate LinkedIn policies; test on a spare account and keep conservative rates. (3) Back up the CSV/TSV before running (the skill reads/writes it). (4) Review and consent to any outreach you send on behalf of your account; avoid scraping or sending to people who did not opt in. (5) The README includes a Python snippet to update files but does not declare a Python requirement — ensure your runtime can safely run any local helper code before executing it.

Like a lobster shell, security has layers — review code before you run it.

latestvk97d43n3ae9c45tetknj77j4g181270x
1.1kdownloads
1stars
2versions
Updated 6h ago
v1.1.0
MIT-0

LinkedIn Connect

Automates sending LinkedIn connection requests from a list and tracks results in a data file.

⚠️ Pre-flight Checklist — Confirm Before Starting

Before doing anything else, confirm all of the following with the user. Do not proceed until each item is confirmed.

1. Data File

Ask the user to provide their spreadsheet/CSV/TSV file and confirm it has (or can have) these columns:

  • Person/Founder Name — full name of the person to connect with
  • Company/Brand Name — their company or brand (used for search fallback)
  • LinkedIn Profile URL — optional but highly recommended; reduces automation footprint

If the file lacks any column, tell the user which columns are missing and offer to add them.

2. Browser Setup

Ask which browser setup they're using:

Option A — Chrome Browser Relay (recommended for accounts flagged for automation)

  • User must have the OpenClaw Browser Relay Chrome extension installed
  • User opens LinkedIn in their regular Chrome browser and clicks the OpenClaw Relay toolbar icon on that tab (badge turns ON)
  • Use profile="chrome" for all browser tool calls in this mode

Option B — OpenClaw Isolated Browser (openclaw profile)

  • OpenClaw manages a separate Chrome instance
  • On first use, navigate to https://www.linkedin.com and let the user log in; cookies persist across sessions
  • Use profile="openclaw" for all browser tool calls in this mode

Confirm which option they've set up. Default to Option A (Chrome Relay) if the user's account has been flagged or warned about automation.

3. Ready Check

Only proceed once the user says:

  • ✅ File is ready and accessible
  • ✅ Browser is open with LinkedIn logged in (and relay is attached if Option A)

Browser Profile

Set the profile variable based on user's choice in the Pre-flight Checklist:

  • Option A: profile="chrome" — reuse the relay-attached tab; get targetId via browser action=tabs
  • Option B: profile="openclaw" — OpenClaw-managed isolated Chrome instance

Do not mix profiles mid-run. Pick one and use it consistently for every browser tool call.

Data File Setup

Ensure the tracking file has a Connection Status column. If missing, add it:

import csv
rows = []
with open('file.tsv', 'r') as f:
    reader = csv.DictReader(f, delimiter='\t')
    fieldnames = reader.fieldnames + ['Connection Status']
    rows = list(reader)
with open('file.tsv', 'w', newline='') as f:
    writer = csv.DictWriter(f, fieldnames=fieldnames, delimiter='\t')
    writer.writeheader()
    for row in rows:
        row['Connection Status'] = ''
        writer.writerow(row)

Three-Tier Profile Discovery (Priority Order)

Always try in this order. Move to the next tier only if the current one fails.

Tier 1 — Direct LinkedIn URL (fastest, zero ambiguity)

Navigate directly to the LinkedIn profile URL from the data file.

  • ✅ URL loads → correct profile, proceed to connect
  • ❌ Returns 404 → escalate to Tier 2
  • Skip Tier 1 if no URL is in the data file for this person

Tier 2 — Google Search (reliable fallback, preserves accuracy)

Search Google for "Founder Name" "Brand/Company" linkedin.

  • Navigate to: https://www.google.com/search?q=<Name>+<Company>+linkedin
  • Find the LinkedIn profile link in results (usually first result), click it
  • Once on the profile, proceed to Connect step
  • ⚠️ Only escalate to Tier 3 if Google can't find the right person or returns no LinkedIn result

Tier 3 — LinkedIn People Search (last resort)

Run a LinkedIn people search for the founder + brand directly inside LinkedIn.

  • Navigate to: https://www.linkedin.com/search/results/people/?keywords=<Name>+<Company>
  • Look for inline Connect buttons first; otherwise open the profile from search results
  • Confirm name + headline/company match before connecting
  • ❌ No trustworthy match → mark Profile Not Found

See references/browser-workflow.md for detailed browser steps for each tier.

Connecting on a Profile

Once on the correct profile, two patterns exist:

Pattern A - Direct Connect button visible on profile → click it → confirm dialog → Send without a note

Pattern B - Follow mode (no Connect button, only Follow + Message + More) → click More actions → use selector .artdeco-dropdown__content--is-open to get dropdown → click Invite [Name] to connect → confirm dialog → Send without a note

If neither Connect nor Invite is available → mark Follow Only.

Status Values

StatusMeaning
Request SentConnection request sent this session
Already Connected1st degree - no action needed
PendingRequest already sent previously
Follow OnlyNo Connect option available on this profile
Profile Not FoundAll three tiers failed
SkippedIntentionally skipped

Multi-founder Rows

When a TSV row has multiple founders, track per-founder status separated by |:

Founder1Slug: Request Sent | Founder2Slug: Already Connected

Rate Limiting & Anti-Detection

⚠️ LinkedIn flags accounts that jump directly between profile URLs. Always visit the feed between profiles — no exceptions.

  • Navigate to /feed/ before every single profile, without exception. See references/browser-workflow.md for the exact call. This is the primary anti-detection measure.
  • Add a short natural pause (2–4 seconds) after loading the feed before navigating to the next profile.
  • If >3 consecutive clean URLs return 404, pause for 10 seconds on the feed before continuing (then fall back to Google/LinkedIn search).
  • Do not open new browser tabs — the relay breaks; reuse the same attached tab for every action.
  • Aim for no more than 20–25 connection requests per session. Stop and tell the user if you're approaching this limit.

Saving Progress

Use a linkedin_progress.json sidecar file:

{ "statuses": { "https://www.linkedin.com/in/username/": "Request Sent" } }

Update the TSV from this dict every 10 profiles or at the end.

References

  • references/browser-workflow.md - Detailed browser steps for all three tiers and both connect patterns

Comments

Loading comments...