linkedin-profile-scraper

Warn

Audited by Gen Agent Trust Hub on Apr 8, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script sets process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0" in scripts/apify-linkedin-search.js, which globally disables SSL/TLS certificate validation for all network requests made by the Node.js process, making the application vulnerable to Man-in-the-Middle (MitM) attacks.
  • [DATA_EXFILTRATION]: The script uses a relative path ../../../onboarding-config.json to access a file outside its own directory structure, which is a directory traversal pattern used to ingest data from the broader environment.
  • [CREDENTIALS_UNSAFE]: When connecting to the PostgreSQL database, the script explicitly sets ssl: { rejectUnauthorized: false }, disabling certificate verification for the database connection and potentially allowing interception of database traffic.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with the well-known Apify platform to execute the harvestapi/linkedin-profile-search actor, which processes search parameters and returns scraped profile data.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 8, 2026, 08:20 AM
Security Audit — agent-trust-hub — linkedin-profile-scraper