linkedin-commenter-extractor
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill communicates with well-known services (Apify and Gooseworks) to perform LinkedIn data extraction. This is consistent with its stated purpose.
- [SAFE]: Secret management follows industry standards, utilizing environment variables for API tokens (APIFY_API_TOKEN or GOOSEWORKS_API_KEY).
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external LinkedIn posts which could contain malicious instructions.
- Ingestion points: LinkedIn comment data fetched via the Apify API in
scripts/extract_commenters.py. - Boundary markers: Not explicitly present for the processed comment text.
- Capability inventory: The skill's capabilities are limited to making network requests to
api.apify.comandapi.gooseworks.ai. It does not have file-write or shell execution capabilities. - Sanitization: Comment text is truncated to 500 characters, though not explicitly sanitized for prompt injection. The risk is mitigated by the lack of dangerous downstream capabilities.
Audit Metadata