kol-content-monitor
Warn
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: MEDIUMPERSISTENCEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PERSISTENCE]: The skill instructions include a crontab entry (
0 14 * * 5 ...) to schedule the monitoring task periodically. This qualifies as a persistence mechanism as it allows for automated execution outside of an active user session. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted content from social media platforms, which could contain malicious instructions designed to influence the agent's behavior during the clustering or reporting phases.
- Ingestion points: Scraped social media posts from LinkedIn and Twitter/X.
- Boundary markers: The skill does not define specific boundary markers or instructions for the agent to disregard instructions found within the scraped content.
- Capability inventory: The skill possesses the ability to execute internal Python scraper scripts, read configuration files, and write markdown reports to the local filesystem.
- Sanitization: There are no specific sanitization steps described to clean or escape the data retrieved from external platforms before the agent processes it.
- [COMMAND_EXECUTION]: The skill provides shell command templates in Phase 1 and Phase 2 that interpolate user-supplied profile URLs and handles. Without proper validation, these placeholders could be manipulated to execute arbitrary commands via shell injection.
- Evidence:
python3 skills/linkedin-profile-post-scraper/scripts/scrape_linkedin_posts.py --profiles "<url1>,<url2>,<url3>"and similar calls in the scraping phases.
Audit Metadata