storyagent_linkedin

Interact with LinkedIn via Unipile API - send messages, view profiles, manage connections, create posts, react to content. Use when the user asks to message someone on LinkedIn, check LinkedIn messages, view LinkedIn profiles, send connection requests, create LinkedIn posts, or interact with LinkedIn content.

Security Scan

The skill's code and instructions legitimately implement LinkedIn actions via the Unipile API, but the package declares no required credentials while the SKILL.md and script do require Unipile credentials — this metadata mismatch and the presence of packaged dependencies merit caution before installing or running.

Purpose & Capability

Name/description, README, SKILL.md and the script all consistently describe interacting with LinkedIn via the Unipile API. However the registry metadata reports "Required env vars: none" and "Primary credential: none", while both SKILL.md and scripts require UNIPILE_DSN and UNIPILE_ACCESS_TOKEN. That mismatch is an incoherence: a LinkedIn integration legitimately needs those credentials, but the published metadata fails to declare them.

Instruction Scope

SKILL.md instructs an agent to run the provided CLI script and to set UNIPILE_DSN and UNIPILE_ACCESS_TOKEN (the script reads only these two env vars). The instructions do not reference unrelated files, system secrets, or unexpected external endpoints — all network calls go to the Unipile DSN provided by the user. Note: SKILL.md suggests storing credentials in a workspace file (~/.openclaw/workspace/TOOLS.md), which could lead to broader credential exposure if that workspace is shared or backed up.

Install Mechanism

There is no install spec (instruction-only skill), which is lower-risk. However the repository includes package.json and package-lock.json (dependencies: dotenv, unipile-node-sdk). If a user or agent attempts to run the script, npm install would be needed to satisfy dependencies — that pulls packages from the public npm registry (supply-chain risk). No download-from-arbitrary-URL behavior or obfuscated installers are present.

Credentials

The functionality legitimately requires Unipile credentials (UNIPILE_DSN and UNIPILE_ACCESS_TOKEN). The problem is that these credentials are not declared in the skill's registry metadata, so a user may not be made aware when granting the skill access. These credentials allow API access to Unipile which can act on LinkedIn on the user's behalf — they are high-value secrets and should be explicitly declared and scoped.

Persistence & Privilege

The skill does not request always:true and does not modify other skills or system-wide settings. It is user-invocable and allows autonomous invocation (platform default), which is expected for tools. No elevated persistence or cross-skill privileges are requested.

What to consider before installing

Before installing or running this skill: (1) Recognize it requires UNIPILE_DSN and UNIPILE_ACCESS_TOKEN (the registry metadata fails to declare them) — treat those as sensitive credentials that grant API access to act on your LinkedIn accounts. (2) Verify the skill source/author and whether you trust the Unipile service and the unipile-node-sdk npm package (supply-chain risk). (3) Prefer creating a least-privileged or revocable token on Unipile (short-lived or scoped) rather than using a long-lived master token. (4) Avoid placing tokens in shared workspace files; store them in a secure secret store or ephemeral environment. (5) If you plan to run the CLI, run npm install in an isolated environment and inspect installed packages. (6) If uncertain about provenance or if the metadata mismatch concerns you, treat installation as risky and either ask the publisher for corrected metadata or run the tool in a sandboxed environment.

Unipile LinkedIn

Access LinkedIn through the Unipile API using the CLI script.

Setup

Requires environment variables in ~/.openclaw/workspace/TOOLS.md or shell:

• UNIPILE_DSN - Your Unipile API endpoint (e.g., https://api1.unipile.com:13111)
• UNIPILE_ACCESS_TOKEN - Your Unipile access token

Get credentials from dashboard.unipile.com.

Usage

Run commands via the CLI script:

./scripts/linkedin.mjs <command> [options]

Commands

Account Management

./scripts/linkedin.mjs accounts                    # List connected accounts
./scripts/linkedin.mjs account <account_id>        # Get account details

Messaging

./scripts/linkedin.mjs chats [--account_id=X] [--limit=N] [--unread]   # List chats
./scripts/linkedin.mjs chat <chat_id>                                   # Get chat details
./scripts/linkedin.mjs messages <chat_id> [--limit=N]                   # List messages in chat
./scripts/linkedin.mjs send <chat_id> "<text>"                          # Send message
./scripts/linkedin.mjs start-chat <account_id> "<text>" --to=<user_id>[,<user_id>] [--inmail]  # Start new chat

Profiles

./scripts/linkedin.mjs profile <account_id> <identifier> [--sections=experience,education,skills] [--notify]
./scripts/linkedin.mjs my-profile <account_id>                          # Your own profile
./scripts/linkedin.mjs company <account_id> <identifier>                # Company profile
./scripts/linkedin.mjs relations <account_id> [--limit=N]               # Your connections

Invitations

./scripts/linkedin.mjs invite <account_id> <provider_id> ["message"]    # Send connection request
./scripts/linkedin.mjs invitations <account_id> [--limit=N]             # List pending invites
./scripts/linkedin.mjs cancel-invite <account_id> <invitation_id>       # Cancel invitation

Posts

./scripts/linkedin.mjs posts <account_id> <identifier> [--company] [--limit=N]  # List posts
./scripts/linkedin.mjs post <account_id> <post_id>                              # Get post
./scripts/linkedin.mjs create-post <account_id> "<text>"                        # Create post
./scripts/linkedin.mjs comments <account_id> <post_id> [--limit=N]              # List comments
./scripts/linkedin.mjs comment <account_id> <post_id> "<text>"                  # Add comment
./scripts/linkedin.mjs react <account_id> <post_id> [--type=like|celebrate|support|love|insightful|funny]

Attendees

./scripts/linkedin.mjs attendees [--account_id=X] [--limit=N]           # List chat contacts

Examples

# List all chats, only unread
./scripts/linkedin.mjs chats --unread

# Send a message
./scripts/linkedin.mjs send "abc123" "Thanks for connecting!"

# View someone's profile with experience section
./scripts/linkedin.mjs profile "myaccount" "john-doe-123" --sections=experience,about

# Send connection request with note
./scripts/linkedin.mjs invite "myaccount" "jane-smith-456" "Hi Jane, let's connect!"

# Create a LinkedIn post
./scripts/linkedin.mjs create-post "myaccount" "Excited to announce our new product launch! 🚀"

# React to a post
./scripts/linkedin.mjs react "myaccount" "post789" --type=celebrate

Notes

• identifier can be a LinkedIn user ID or profile URL slug
• account_id is your connected LinkedIn account ID (get from accounts command)
• Use --inmail flag when messaging non-connections (requires LinkedIn Premium)