Yunlv Linkedin Writer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:28 AM UTC
• Version: 1.1.0

Overview

This LinkedIn outreach skill is not clearly malicious, but it needs review because it can send prospect details to an external AI API while making contradictory privacy claims.

Review this before installing if you handle prospect or customer data. Treat names, LinkedIn URLs, job titles, employers, and notes as potentially personal data that may be sent to Yunlv AI when external generation is used, despite the skill's conflicting privacy language. Use it only with appropriate consent or legal basis, avoid unnecessary identifiers, and do not rely on the stated retention or deletion guarantees unless the publisher provides enforceable terms.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:266

Finding

Contradictory Privacy Disclosures for External Prospect Data Processing

Content

View full analysis

Skill | Input | Target-customer background supplied by the user | Build the message-generation request | Local processing | | Skill -> Yunlv AI API | Request | Industry, position, company, and other background information | Generate personalized message content | TLS 1.3 encrypted transmission | - API use is limited to text generation: The Yunlv AI API receives the background description and returns generated text. No personal information is transmitted externally. - Customer background is not stored: Target-customer background is used only for the current generation request and is not persistently stored. - Minimum retention: Message-generation records are retained for 30 days and are automatically deleted afterward. Logs do not record personally identifiable information. - Local first: All message content is stored in the user's local directory and is not automatically uploaded. - Allowed: Call the Yunlv AI API to generate message text. ``` ### Technical Analysis The Skill explicitly permits sending a prospect's industry, position, company, and other background information to `https://api.yunlvai.com`. Such information may directly or indirectly identify a natural person, particularly when combined with profile activity, employer details, job title, or message context. This declared external transfer conflicts with the assertion that no personal information is transmitted externally. The documentation also states both that customer information is not persistently stored and that message-generation records are retained for 30 days. In addition, the claim that all message content remains local conflicts with the declared use of an external generation API. The ...[truncated 1938 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (18)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The declared description centers on generating/writing professional B2B outreach messages. The code does not generate outreach messages directly. Instead, its main functions are to evaluate existing message content, analyze readability and message structure, design multi-round follow-up sequences, and recommend industry-specific hooks. These are adjacent sales enablement capabilities, but they are materially different from the declared primary purpose of message creation. There are no concerning hidden permissions or external resource accesses, but the functionality is broader and different enough to qualify as a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The compliance section says the skill does not collect or process personal information, but the rest of the skill clearly handles named prospects, job titles, companies, and LinkedIn profile details to generate outreach. This is a significant privacy/compliance misrepresentation that may lead to unlawful processing, inadequate consent handling, and improper cross-border transfer of personal data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Overly broad triggers can cause the skill to activate in contexts the user did not intend, which is risky here because the skill may encourage sharing prospect information and sending external API requests. Unintended activation increases the chance of accidental disclosure, workflow confusion, or misuse of a capability involving third-party personal/business data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Nearly all instructional content, labels, cautions, and examples are presented in Chinese, while the skill does not explicitly offer the user a language choice for the skill’s own interface or documentation. Although generated messages may support multiple languages, the natural-language instructions themselves appear to assume a Chinese-reading user by default.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill claims no personal information is transmitted externally, yet its own workflow states that prospect background details are sent to the Yunlv AI API. This inconsistency can cause users to share personal or profile-derived data under false privacy assumptions, creating undisclosed third-party data exposure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document states customer background information is not persistently stored, but it also defines local storage paths for messages, sequences, templates, and logs. Even if raw background fields are not intended to be stored, generated messages and logs can still embed personal or company-identifying details, so the claim is materially misleading.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description defines activation in broad, generic terms like professional communication and outreach message creation, which can cause the skill to be selected in ordinary writing contexts beyond its intended scope. Overbroad routing increases the chance that user content is unnecessarily sent to an external API, creating privacy, data-handling, and prompt-routing risk even if the skill itself is not overtly malicious.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger set includes generic business-writing phrases that are likely to appear in normal conversations, making accidental invocation plausible. In a skill that relies on a third-party service, this broad matching can expose unrelated user prompts or business content to external processing without clear user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The explicit trigger list contains vague standalone terms such as LinkedIn, 领英, and 联系消息 without context requirements, which creates a high risk of trigger collision with benign discussion. Because the skill calls an external API using an API key, accidental activation can route sensitive drafts, contact details, or internal sales context outside the primary system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The document title and section headings are written in Chinese, which indicates the skill content is localized to a specific language. There is no accompanying note that the language is optional, user-selectable, or justified as a region-specific resource, so this creates a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This Python skill includes its natural-language description, command help text, and user-facing strings exclusively in Chinese. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified or alternatives are offered.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/linkedin-optimizer.py (reported line 255)May include surrounding context.

python

"word_count": len(message.split()),
        "paragraphs": message.count('\n\n') + 1,
        "has_bullet_points": '•' in message or '-' in message or '*' in message,
        "has_numbers": bool(__import__('re').search(r'\d+', message)),
        "has_emoji": any(ord(c) > 127000 for c in message),
        "readability": _assess_readability(message)
    }

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 70% confidence

Finding

Overly Broad Trigger: '领英' is too short and may match unintended inputs

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This markdown file presents the skill content in a fixed mixed-language format: section titles and instructions are in Chinese while the actual message templates are in English. Because the file does not state that users can choose their preferred language or locale, it may conflict with a policy requiring language choice or opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest describes the skill as generating professional B2B outreach message content, especially LinkedIn message writing. This function designs a full follow-up sequence with timing, channel selection, and outreach strategy across email and LinkedIn, which is broader than composing message content itself.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 74% confidence

Finding

The manifest centers on writing professional B2B outreach messages for prospects. This code provides a reusable industry hook library and matching logic, which is adjacent to writing but is more of a sales enablement/recommendation capability than direct message generation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.