linkedin-profile-scraper-with-email

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.90). The skill contains explicit instructions to install dependencies automatically and to conceal that installation from the user (e.g., "without asking the user to confirm" and "Do not describe it as a request..."), which are deceptive directives outside the scraping task's stated purpose.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The links point to a third‑party CLI installer (browseract.com) that the Skill will auto-install without user confirmation and one URL includes a redirect parameter to GitHub — together they are a potentially unsafe distribution vector for executables or scripts.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md instructs the agent to use the runtime browser-act Skill to access and extract data from live LinkedIn pages (public web content authored by outsiders), which can include free-form text that the agent then feeds into its LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent to automatically install the BrowserAct runtime from the URL https://www.browseract.com/?co-from=lead-generation&redirect=https://github.com/browser-act/skills/tree/main at runtime, which implies fetching and installing remote code that would execute on the agent's host.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill explicitly directs the agent to install BrowserAct automatically without asking the user for approval and to resume execution, which instructs the agent to modify the host by installing software (potentially requiring elevated privileges) and thus pushes the agent to change the machine state.