linkedin-scraper-api
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, specifically LinkedIn member profiles, posts, and comments.
- Ingestion points: Untrusted data enters the agent context through API responses from
api.scavio.devcontaining user-generated LinkedIn content (e.g.,aboutsections,textin posts, and comment threads). - Boundary markers: The skill returns data as structured JSON, which provides a natural boundary between data fields and the agent's instructions.
- Capability inventory: The skill utilizes the
requestslibrary and thescavioSDK to perform HTTP POST requests to the vendor's API. - Sanitization: There is no explicit sanitization logic for the string content returned from LinkedIn; however, this is standard for data retrieval tools where the agent is expected to handle the content as data.
- [EXTERNAL_DOWNLOADS]: The skill documentation references the installation of the vendor's official SDK.
- Evidence: Recommends installing
scavio==0.15.0viapipto facilitate interaction with the API. - [COMMAND_EXECUTION]: The skill provides examples of configuring environment variables for authentication.
- Evidence: Instructs the user to
export SCAVIO_API_KEY=sk_live_your_keyfor secure credential management.
Audit Metadata