AI Roast Linkedin Profile

PassAudited by ClawScan on May 1, 2026.

Overview

The skill is a coherent hosted LinkedIn-roast generator, with the main considerations being use of a Constants API key and sending a LinkedIn profile URL to Constants for processing.

Before installing, confirm you are comfortable using the hosted Constants service, protecting your Constants API key, and sending the LinkedIn profile URL/profile-derived content to Constants. Use the tool only for appropriate profiles and avoid submitting confidential or non-consensual data.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

The API key authorizes calls against the user's Constants account, so exposure or misuse could cause unwanted account usage.

Why it was flagged

The artifact clearly requires a Constants API key. This is expected for a hosted Constants tool and there is no evidence of hardcoded credentials or unrelated credential use.

Skill content

required_env_vars:
  - CONSTANTS_API_KEY
primary_credential: CONSTANTS_API_KEY

Recommendation

Keep the Constants API key secret, use a limited-scope key if Constants supports it, and revoke/regenerate the key if it is exposed.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

The submitted profile URL and resulting profile-derived content may be processed by Constants to generate the roast audio and text.

Why it was flagged

The skill sends the supplied LinkedIn profile URL to the external Constants API for hosted processing, which is central to the stated purpose but is still an external data flow.

Skill content

curl -X POST https://www.constants.io/api/v1/run/linkedin_ai_roast_generator_0edc9796 ... -d '{"linkedinUrl":"..."}'

Recommendation

Only submit profiles you are comfortable sending to Constants, and review Constants' privacy and usage terms before using the tool.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing and running the skill depends on the Constants CLI/package and hosted backend rather than local reviewed code in the artifact.

Why it was flagged

The skill relies on a hosted Constants tool and a Constants npm/CLI installation path. This is disclosed and purpose-aligned, but users are trusting that external tooling and hosted service.

Skill content

source: hosted ... package: constants-skills ... npx constants-skills install linkedin_ai_roast_generator_0edc9796

Recommendation

Install Constants tooling from the official source, verify the package name before running npx commands, and keep the CLI updated.