Security audit

linkedin-research

Security checks across malware telemetry and agentic risk

Overview

The skill is described as a narrow LinkedIn lookup tool, but its bundled helper can call arbitrary Crawlora API paths and methods with the user's API key.

Review before installing. This does not show hidden persistence or exfiltration, but it should be treated as broader than a LinkedIn-only lookup skill unless the helper is restricted to the documented GET endpoints and the generic examples and method/path escape hatches are removed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The script is documented and implemented as a generic Crawlora REST client, even though the skill is supposed to be limited to LinkedIn company, product, and showcase lookups. This creates a scope-expansion vulnerability: any caller able to invoke the skill can repurpose it to access unrelated Crawlora endpoints, potentially enabling unauthorized data retrieval or policy bypass under the guise of a narrowly scoped skill.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The code accepts an arbitrary API path from user-controlled arguments and concatenates it directly onto the Crawlora API base URL. In the context of a skill advertised as LinkedIn-only, this means the tool can be used as a general-purpose proxy to any Crawlora-supported endpoint, defeating least-privilege boundaries and enabling misuse beyond the declared purpose.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The helper permits arbitrary HTTP methods via -X, including POST and potentially other state-changing verbs, despite the skill being described as a read-only LinkedIn lookup tool. This broadens the attack surface and could allow callers to interact with Crawlora functionality in unintended ways, including endpoints that accept writes, task creation, or other side effects.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The documentation explicitly frames the script as a minimal generic Crawlora REST helper and includes examples for unrelated services such as Amazon, YouTube, and Google. This increases the likelihood of operator misuse and makes the skill materially more dangerous because it signals that broad API access is intentional, contradicting the declared LinkedIn-only scope and encouraging policy-evading usage.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:23