ClawHub
Back to skill

Security audit

Skill Linkedin

Security checks for vulnerabilities and agentic risk

Overview

This LinkedIn outreach skill is coherent, but it needs review because it requires a raw LinkedIn session token and includes account-level message sending behavior.

Review before installing. Do not provide a raw LinkedIn session token unless you fully trust the runtime and understand it may grant account-level access. Prefer an OAuth flow with explicit consent, keep message generation separate from message sending, and require confirmation before any automatic LinkedIn sends. Expect local storage of imported profiles, generated messages, sent records, and logs.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
clawhub.yaml:14
Finding

Mandatory LinkedIn Session Token Violates Least-Privilege Access

Content
View full analysis

Vulnerability Details

File Location: clawhub.yaml:14-17
Related Location: SKILL.md:37-50
Vulnerability Type: Excessive credential requirement and inconsistent authentication configuration
Risk Level: Medium

yaml
required_env:
- TRADEGPT_API_KEY
- LINKEDIN_SESSION_TOKEN
primary_env: TRADEGPT_API_KEY

Technical Analysis

The package manifest requires LINKEDIN_SESSION_TOKEN to be supplied to the Skill runtime. This conflicts with SKILL.md, where the same credential is described as optional and the documented LinkedIn integration uses user-authorized OAuth.

A raw authenticated session token can provide broader access than a narrowly scoped OAuth access token. Requiring it for installation or execution unnecessarily places a reusable account credential in the runtime environment, where the Skill host, future implementation code, subprocesses, extensions, or compromised dependencies could potentially read it.

The audited package contains documentation and templates rather than executable scripts, and no credential theft or exfiltration implementation was identified. The vulnerability is therefore the excessive credential requirement and resulting exposure boundary, not evidence that the current package actively steals the token.

Attack Path

  1. A user installs or configures the Skill and is instructed by the manifest to provide LINKEDIN_SESSION_TOKEN.
  2. The session token is placed in the Skill runtime environment.
  3. A runtime component, future Skill implementation, compromised dependency, or other process with access to that environment reads the credential.
  4. The exposed token is replayed against LinkedIn while it remains valid.
  5. The attacker acts through the authenticated LinkedIn session within the permissions and security restrictions associated with that token.

This path requires an additional component capable of reading or disclosing environment variables; no such ...[truncated 772 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove LINKEDIN_SESSION_TOKEN from required_env.
  2. Use LinkedIn's supported OAuth authorization flow with explicit user consent.
  3. Request only the minimum scopes needed for the selected operation, separating message generation from message delivery.
  4. Store OAuth tokens in a dedicated secret manager rather than general environment variables where supported.
  5. Use short-lived access tokens and support immediate revocation and rotation.
  6. Never request browser cookies, raw session tokens, or other credentials that can reproduce a full authenticated session.
  7. Make clawhub.yaml and SKILL.md consistent about whether LinkedIn integration is optional and which authentication method it uses.
  8. Ensure the message-generation feature works without any LinkedIn credential; request OAuth authorization only when the user explicitly enables LinkedIn API operations.
  9. Prevent credentials from appearing in logs, generated messages, diagnostic output, or third-party API requests.
  10. Add automated manifest validation to reject session-cookie or session-token requirements when a scoped OAuth mechanism is available.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger list contains broad, generic terms related to LinkedIn and social selling that may appear in ordinary user conversations, causing the skill to activate unexpectedly. Unintended invocation can route user data into this skill's workflow, increasing the chance of privacy exposure, incorrect automation, or accidental use of external APIs in contexts the user did not intend.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Requiring a LinkedIn session token is sensitive because session cookies/tokens typically grant direct account access and are often more dangerous than scoped API credentials. Listing it without any handling, storage, rotation, or least-privilege disclosure creates a credible risk of credential misuse, insecure collection, or accidental exfiltration through the skill ecosystem.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest advertises social-graph queries and message sending without any warning about privacy, consent, platform-policy, or account consequences. In a LinkedIn outreach skill, those omissions are risky because users may supply third-party data or automate messaging in ways that violate expectations, expose personal information, or create account-enforcement risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger list is broad enough to activate on common discussion terms like 'LinkedIn', '领英', and general social-marketing phrases, which can cause the skill to engage in contexts where the user did not explicitly request automation or outreach generation. In this skill, that matters because the capability includes lead generation and automated messaging, increasing the chance of unintended handling of professional contact data or unsolicited message workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document is entirely presented in Chinese while many embedded hook templates are in English, indicating a language constraint in the skill content rather than a user-selected option. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no choice or justification is documented.

Content

No source excerpt is available for this finding.

Overly Broad Trigger

Low
Category
Trigger Abuse
Confidence
95% confidence
Finding

The trigger '领英' is very short and likely to appear in benign discussion about LinkedIn, making accidental activation particularly likely. While not directly enabling code execution, it can invoke outreach-generation behavior or downstream integrations without sufficient user intent, which is a security and privacy concern in agent environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file title and instructional content are presented in Chinese, and there is no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.