linkedin

SUSPICIOUS: the skill's purpose broadly matches LinkedIn account actions, but it depends on an unofficial third-party package and requires raw LinkedIn session cookies instead of official OAuth. There is no clear evidence of overt exfiltration or malware, yet the combination of mutable third-party dependency, cookie forwarding, and unofficial auth flow creates meaningful security risk.