linkedin-message-writer

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly scrapes public LinkedIn profiles and recent posts using Apify actors (see "Phase 2: Research" — harvestapi/linkedin-profile-scraper and harvestapi/linkedin-profile-posts) and then uses that untrusted, user-generated content to generate and drive personalized outreach messages, so external page content can materially influence agent behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). This skill calls Apify endpoints at runtime (e.g., https://api.apify.com/v2/acts/harvestapi~linkedin-profile-scraper/runs?token=$APIFY_API_TOKEN and https://api.apify.com/v2/acts/harvestapi~linkedin-profile-posts/runs?token=$APIFY_API_TOKEN) to fetch profile/posts which are then injected into the agent's prompt context to directly control generated messages, and those calls are required (APIFY_API_TOKEN), so they meet the criteria for a runtime external dependency that controls prompts.