linkedin-skills
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions define an orchestration workflow where raw user input is interpolated directly into shell command arguments to invoke routing and policy scripts. This creates a vulnerability surface where malformed or adversarial input could attempt to break out of the command context if the executing agent does not apply rigorous shell escaping.
- Ingestion points: User-provided goals and tactics are ingested via the
--textargument inscripts/linkedin_policy_gate.pyandscripts/linkedin_goal_router.pyas described inSKILL.mdsteps 1 and 2. - Boundary markers: The interpolation templates in
SKILL.md(e.g.,python3 ... --text "<the user's own words>") do not utilize explicit delimiters, XML tags, or escaping instructions to isolate untrusted data from the command structure. - Capability inventory: The provided scripts are limited to keyword scoring, regex matching, and deterministic routing using only the Python standard library. No capabilities for network access, file system modification, or privilege escalation were detected in the analyzed files.
- Sanitization: The scripts perform regex-based classification for policy enforcement but do not sanitize inputs for shell-meta characters before they are processed by the CLI argument parser.
Audit Metadata