linkedin-skills
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input to categorize tasks and check for policy violations. This represents an attack surface where a user could craft inputs to bypass the regex-based safety filters or manipulate routing logic.
- Ingestion points: User input enters via the --text argument in scripts called from SKILL.md Step 1 and Step 2.
- Boundary markers: Input is enclosed in double quotes in command templates but lacks explicit 'ignore instructions' delimiters for the processing scripts.
- Capability inventory: Sub-skill routing and policy enforcement across five distinct lanes.
- Sanitization: The skill uses deterministic regex filtering in linkedin_policy_gate.py to detect and refuse prohibited LinkedIn tactics.
- [COMMAND_EXECUTION]: The orchestration logic in SKILL.md uses a pattern of interpolating user-provided strings directly into shell command templates. This is susceptible to argument injection (e.g., using the --input flag to read local files) or command injection if the agent environment executes the resulting string in a shell without proper sanitization.
- Evidence: SKILL.md contains command templates for policy checking and goal routing that directly embed user-controlled strings, such as
python3 scripts/linkedin_policy_gate.py --text "<the user's own words>".
Audit Metadata