The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions direct users to install the @linkedapi/linkedin-cli package globally using NPM. This package is hosted on the public NPM registry and is provided by a third-party source.
[CREDENTIALS_UNSAFE]: Setup instructions involve passing the Linked API Token and Identification Token as plaintext command-line arguments using the --linked-api-token and --identification-token flags. This pattern can lead to credential leakage as these sensitive tokens may be captured in shell history files or become visible to other users on the system via process monitoring tools.
[DYNAMIC_EXECUTION]: The linkedin workflow run command enables the execution of automated sequences defined in external JSON files. This creates a risk if the agent is persuaded to execute a workflow from an untrusted or maliciously crafted source.
[INDIRECT_PROMPT_INJECTION]: The skill handles data from LinkedIn that is controlled by external parties, creating a surface for indirect prompt injection attacks.
Ingestion points: The skill reads external content through commands like linkedin person fetch (which retrieves profiles and posts), linkedin message get (which retrieves inbound messages), and linkedin post fetch (which retrieves comments and reactions).
Boundary markers: The skill instructions do not specify any delimiters or safety prompts for the agent to differentiate between user instructions and data retrieved from LinkedIn.
Capability inventory: The agent can take significant actions including linkedin message send, linkedin post create, and linkedin connection send, which could be triggered by instructions hidden in fetched content.
Sanitization: The skill description lacks any mention of sanitizing or validating retrieved data before it is processed by the language model.
[COMMAND_EXECUTION]: The skill operates entirely through a CLI tool, granting the agent the ability to execute a wide range of LinkedIn automation commands on behalf of the user.

linkedin