LinkedIn Automation by Linked API — 技能工具
v1.0.1[自动翻译] LinkedIn automation skill — search people and companies, fetch profiles, send messages and InMails, manage connections, create posts, react, comment. ...
1· 454·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's instructions line up with a LinkedIn automation CLI, but it relies on an external third‑party service and requests sensitive account tokens without declaring them in the registry—exercise caution before installing or providing credentials.
评估建议
This skill appears to do what it says (automate LinkedIn via a CLI), but it depends on a third‑party service (app.linkedapi.io) that uses a cloud browser to act on your LinkedIn account. Before installing or providing any tokens: 1) Verify the npm package (@linkedapi/linkedin-cli) author/publisher and inspect the package on the npm registry (and ideally its source code) to confirm behavior. 2) Confirm app.linkedapi.io's identity and review its privacy/security policy—understand exactly what the ...详细分析 ▾
ℹ 用途与能力
The name/description (LinkedIn automation) matches the behavior described in SKILL.md: a CLI that can fetch profiles, search, send messages, post, etc. Requiring authentication tokens to control a LinkedIn account is expected. However, the registry metadata lists no required credentials or primaryEnv while the runtime instructions explicitly require two tokens (Linked API Token and Identification Token). That mismatch (no declared primary credential but clear runtime requirement) is an incoherence worth noting.
⚠ 指令范围
The SKILL.md instructs the agent (and user) to install and use a third‑party CLI (@linkedapi/linkedin-cli) and to obtain two tokens from app.linkedapi.io. The service runs a 'cloud browser' that performs actions on the user's LinkedIn account. That means sensitive credentials and account actions will be transmitted to and executed by an external service. While this is necessary for the stated automation capability, it expands the trust surface considerably (credential sharing, remote actions, and possible data disclosure). The instructions do not reference reading arbitrary local files or other unrelated environment variables.
ℹ 安装机制
There is no install spec in the registry (instruction-only skill), but SKILL.md tells users to run: npm install -g @linkedapi/linkedin-cli. Installing a global npm package from the public registry is a reasonable distribution method for a CLI, but it carries moderate risk because the package will execute code on the host and the registry entry provides no information about the package author, homepage, or auditability. The instruction to install from npm is expected for a CLI but would be safer if the skill metadata included the package source and publisher.
⚠ 凭证需求
The skill requires two sensitive tokens (Linked API Token and Identification Token) for full functionality. Those tokens effectively grant the third‑party service the ability to perform LinkedIn actions on the user's behalf (send messages, connect, post). The registry metadata lists no required env vars or primary credential, but the runtime flow expects tokens to be provided and stored via the CLI. That omission in metadata reduces transparency and makes it harder for users to spot the risk before installation.
✓ 持久化与权限
The skill does not request 'always: true' and uses default model invocation settings. There is no instruction in SKILL.md to modify other skills or system-wide agent settings. The CLI will likely store tokens locally when run (per the setup command), which is normal for a CLI but should be checked by the user.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.12026/2/25
Optimized description for better search discoverability
● 无害
安装命令 点击复制
官方npx clawhub@latest install linkedapi-linkedin
镜像加速npx clawhub@latest install linkedapi-linkedin --registry https://cn.clawhub-mirror.com
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制