Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed LinkedIn inbox helper that uses a Linxa bearer token to read and manage conversations, with some scope wording users should notice.
Install only if you are comfortable letting Linxa and your agent access LinkedIn-derived inbox data through LINXA_TOKEN. Review the Chrome extension and Linxa account permissions, revoke the token when no longer needed, and confirm before allowing comment creation or marking conversations as read.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
**Prerequisites**:
1. Install the Linxa Chrome Extension
2. Sign in at https://app.uselinxa.com/ with your LinkedIn account
3. Generate an access token at https://app.uselinxa.com/setup-mcp
4. Set: export LINXA_TOKEN=YOUR_TOKEN
**Authentication**:
The skill explicitly says to trigger whenever the user mentions Linxa, which is broader than the skill’s stated functional scope of LinkedIn inbox and lead-management tasks. This can cause unintended invocation in unrelated conversations, increasing the chance of unnecessary access to LinkedIn-derived data or user confusion about why this skill was activated.
The instruction to 'always use this skill for any LinkedIn messaging or LinkedIn lead management task' is overly absolute and can override normal intent disambiguation. In practice, that can route loosely related requests into a tool that can read messages, fetch threads, add comments, and mark conversations as read, creating unnecessary exposure and the possibility of unintended state-changing actions.
No suspicious patterns detected.