ClawHub
Back to skill

Security audit

Skill Linkedin

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly drafts LinkedIn outreach, but it unnecessarily requires a sensitive LinkedIn session token without explaining its use.

Review before installing. Use this only as a drafting aid unless the publisher removes or fully explains the LinkedIn session token request; do not provide a LinkedIn session token without clear scope, storage, revocation, and transmission details.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
clawhub.yaml:14
Finding

Unnecessary LinkedIn Session Credential Requirement Violates Least Privilege

Content
View full analysis

Vulnerability Details

File Location: clawhub.yaml, lines 14-16
Vulnerability Type: Excessive credential access / unnecessary authenticated-session exposure
Risk Level: Medium

Vulnerable Configuration

yaml
required_env:
- TRADEGPT_API_KEY
- LINKEDIN_SESSION_TOKEN

The conflicting declaration in SKILL.md, lines 21-24, is:

yaml
requires:
  env:
    - TRADEGPT_API_KEY
    - LINKEDIN_SESSION_TOKEN  # optional

Technical Analysis

The package declares LINKEDIN_SESSION_TOKEN as a required environment variable in clawhub.yaml, even though the documented workflow only generates outreach text for the user to copy and send manually. The skill also states that it must not obtain LinkedIn search results without authorization.

A LinkedIn session token represents an authenticated user session and is substantially more privileged than the text-generation task requires. Making this credential available to the skill runtime violates the principle of least privilege and unnecessarily increases the consequences of a compromised runtime, dependency, API integration, or future package modification.

The two manifests are also inconsistent: clawhub.yaml makes the token mandatory, while SKILL.md describes it as optional. A runtime using the package manifest may request and expose the token regardless of the documented limitation.

No executable code that currently reads, transmits, or abuses the token was found. The vulnerability is therefore the unnecessary grant and exposure of privileged authentication material, not confirmed credential exfiltration.

Attack Path

  1. A user installs or enables the skill.
  2. The runtime processes clawhub.yaml and requests both declared environment variables.
  3. The user supplies LINKEDIN_SESSION_TOKEN because it is marked as required.
  4. The authenticated session credential becomes available within the skill execution environment despite not being needed for message generation.
  5. If the r ...[truncated 1062 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove LINKEDIN_SESSION_TOKEN from required_env in clawhub.yaml.
  2. Remove the token declaration from SKILL.md so both manifests accurately reflect the manual message-generation workflow.
  3. Retain only TRADEGPT_API_KEY if the external message-generation API is genuinely required.
  4. If authenticated LinkedIn functionality is added later, request authorization only when that specific feature is invoked rather than at installation or startup.
  5. Prefer an official OAuth flow with narrowly scoped, short-lived credentials instead of accepting raw session tokens.
  6. Clearly document the requested scopes, intended operations, credential lifetime, storage behavior, revocation procedure, and external recipients.
  7. Ensure secrets are never written to logs, generated messages, persistent skill data, error output, or third-party endpoints unrelated to the authorized operation.
  8. Add automated manifest validation to reject undocumented credentials and detect inconsistencies between clawhub.yaml and SKILL.md.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The description-based activation criteria are broad enough to cover general LinkedIn lead generation and engagement assistance, not strictly message drafting. In an agent ecosystem, ambiguous activation conditions can route unrelated user requests into this skill, causing unnecessary loading of prospecting instructions and possible mishandling of data or user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes broad phrases such as 'LinkedIn', '领英', and related generic social-selling terms that could activate the skill for routine discussion, not just outreach-message generation. Overbroad invocation can cause the agent to enter an unintended mode, increasing the chance of processing unnecessary personal/prospect data or producing outreach-oriented content when the user wanted general advice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill's privacy section claims it only uses user-provided LinkedIn profile data and does not proactively collect data, but earlier workflow steps state it will read public profile details, posts, interactions, and company updates from LinkedIn URLs. This inconsistency can mislead users about what data is accessed and processed, undermining informed consent and creating privacy/compliance risk if operators rely on the narrower statement.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest requests a LINKEDIN_SESSION_TOKEN even though the declared API only references YunlvAI's own backend for message generation and optimization, with no explicit LinkedIn API operation or justification shown. Requiring a live LinkedIn session token can expose a highly sensitive account credential to the skill or its backend, enabling account access, scraping, messaging, or other actions beyond the user's expectation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill asks for a LinkedIn session token but provides no user-facing warning about the sensitivity of that credential, what data/actions it enables, or whether it will be sent to YunlvAI infrastructure. In a LinkedIn outreach context, this is especially risky because users may assume the skill only drafts text, while the token could allow broader account access and create privacy, impersonation, or account-compromise exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file title and all instructional content are written in Chinese, while the embedded templates are mixed-language and do not indicate that Chinese is optional or required for a region-specific use case. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest positions the skill as generating personalized LinkedIn connection requests and LinkedIn outreach messages. However, this reference file includes broader email follow-up sequences such as cold email, inquiry response, and trade-show follow-up, which are separate outreach channels and business processes beyond LinkedIn messaging.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The document title and section headings are written in Chinese throughout, while the file provides no indication that Chinese is optional, user-selected, or required for a region-specific use case. Under the language/locale policy, hard-coding a single language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Overly Broad Trigger

Low
Category
Trigger Abuse
Confidence
88% confidence
Finding

The trigger '领英' is very short and highly generic, making accidental matches likely in ordinary conversation about LinkedIn. While not directly enabling code execution or exfiltration, it increases unintended skill activation risk, which can lead to context confusion and unnecessary processing of outreach-related instructions or data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.