linkedin-commenter-extractor

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow calls the public Apify actor harvestapi~linkedin-post-comments, fetches its dataset items at runtime, and then places outsider-authored LinkedIn comment free text (commentary/comment_text/text) into the script’s output fields (which would be ingested by any downstream LLM step), creating an indirect prompt-injection path from third-party content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The script uses the Gooseworks proxy APIFY base URL https://app.gooseworks.ai at runtime to start and fetch an Apify actor run (harvestapi~linkedin-post-comments), which executes remote scraping code and is required for the skill to work.