linkedin-profile-scraper
Warn
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script sets
process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0"inscripts/apify-linkedin-search.js, which globally disables SSL/TLS certificate validation for all network requests made by the Node.js process, making the application vulnerable to Man-in-the-Middle (MitM) attacks. - [DATA_EXFILTRATION]: The script uses a relative path
../../../onboarding-config.jsonto access a file outside its own directory structure, which is a directory traversal pattern used to ingest data from the broader environment. - [CREDENTIALS_UNSAFE]: When connecting to the PostgreSQL database, the script explicitly sets
ssl: { rejectUnauthorized: false }, disabling certificate verification for the database connection and potentially allowing interception of database traffic. - [EXTERNAL_DOWNLOADS]: The skill interacts with the well-known Apify platform to execute the
harvestapi/linkedin-profile-searchactor, which processes search parameters and returns scraped profile data.
Audit Metadata