ClawHub
Back to skill

Security audit

AI Roast Linkedin Profile

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed hosted Constants tool for turning a LinkedIn profile URL into roast text and audio, with privacy considerations but no evidence of hidden or destructive behavior.

Install only if you are comfortable using Constants' hosted service for the submitted LinkedIn profile. Protect your Constants API key, review Constants' privacy and retention practices, and avoid submitting profiles unless you have consent or another appropriate basis to process that person's profile data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly states it scrapes a LinkedIn profile, and the HTTP fallback shows that profile data is sent to a remote Constants endpoint for processing. However, the description and usage do not clearly warn users that third-party profile data will be collected and transmitted off-platform, which creates a meaningful privacy and consent risk.

External Transmission

Medium
Category
Data Exfiltration
Content
If the CLI is not available, call the REST API directly:

```bash
curl -X POST https://www.constants.io/api/v1/run/linkedin_ai_roast_generator_0edc9796 \
  -H "Authorization: Bearer $CONSTANTS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"linkedinUrl":"..."}'
Confidence
89% confidence
Finding
curl -X POST https://www.constants.io/api/v1/run/linkedin_ai_roast_generator_0edc9796 \ -H "Authorization: Bearer $CONSTANTS_API_KEY" \ -H "Content-Type: application/json" \ -d

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.