linkedin-growth

SUSPICIOUS. The skill is internally coherent for LinkedIn growth automation and uses a plausibly official npm-distributed CLI, but it enables autonomous scheduled outreach and routes tokens/actions through external tooling. The main concern is high-risk autonomy abuse, not confirmed malware.

This module functions as a cross-platform persistence/task-scheduling installer that repeatedly executes a package-provided script (tick.mjs) via launchd/systemd/cron/schtasks. In the shown fragment there is no direct evidence of malware behaviors such as network exfiltration or credential theft, but the code has significant security sensitivity due to enabling recurring background execution and due to injection-prone string interpolation when embedding PATH and command arguments into scheduler configuration (especially the cron line with shell redirection). Full risk assessment requires reviewing the executed tick.mjs and any referenced helper modules (paths/config) for the actual behavior of the scheduled task.