linkedin-commenter-extractor

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This tool is explicitly designed to harvest LinkedIn commenters (personal/profile data) — using a user-supplied li_at session cookie or an Apify token — and export/send that data for lead-generation, which constitutes deliberate data-harvesting/privacy-abuse (data exfiltration) even though there are no hidden evals/obfuscated backdoors or remote shells in the code.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider-authored free text is ingested at runtime via the keyless Playwright path: extract_commenters.py shells out to li_comments_playwright.mjs, which navigates to user-supplied LinkedIn --post-urls and extracts each commenter’s text from the DOM (.comments-comment-item__main-content / related selectors) into JSON/CSV output that is then processed by the script (and could be forwarded downstream).