kol-engager-icp

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The script deliberately harvests LinkedIn user data (profile URLs, names, positions, comment text) and sends profile/post URLs and payloads to external scraping actors/services (Apify/GooseWorks), which is an intentional data-exfiltration and supply-chain risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The script uses the Gooseworks proxy (https://app.gooseworks.ai) at runtime to launch and fetch results from Apify actors (third‑party code that executes remotely), which the skill depends on to operate.