Is oathe-ai/linkedin-growth-engine safe?
https://github.com/oathe-ai/linkedin-growth-engine
The linkedin-growth-engine skill suite is a legitimately-architected LinkedIn content creation system with a complex multi-agent pipeline (researcher, drafter, critic, simplifier, persona-refiner). The primary security concerns are not adversarial injection but privacy-invasive by design: the linkedin-trends skill explicitly instructs reading the user's iMessage database and browser history to extract LinkedIn URL signals, which constitutes significant surveillance of private communications even when gated by opt-in flags. The skill also includes dangling symlinks pointing to the developer's absolute macOS paths, a bundled MCP OAuth server managing LinkedIn tokens, and hook-invoked shell scripts on every publish event. Clone-time behavior was clean with no unexpected network activity or canary file exfiltration.
Category Scores
Findings (8)
HIGH iMessage Database Surveillance -25 ▶
The linkedin-trends SKILL.md instructs the agent to query ~/Library/Messages/chat.db using SQL to extract all messages from the past 7 days containing linkedin.com URLs. This provides access to private message content including sender/receiver context around any matched URL, stored into learnings.db.peer_signal.
MEDIUM Browser History and Bookmarks Extraction -15 ▶
The skill instructs querying Safari's History.db and Chrome's History SQLite database for LinkedIn URLs visited in the past 7 days, ranked by visit_count and recency. Bookmarks from both browsers are also scraped. All data is stored in learnings.db.peer_signal with a source field.
MEDIUM Deep Persona Takeover via INHABIT Instruction -15 ▶
The skill explicitly instructs the agent to 'INHABIT the writer' — not assist the writer, but become them. The 6-gate drafter protocol (Gates 0–6) defines precise cognitive steps the agent must perform including first-person present-tense self-identification as the persona, eliminating the agent's default perspective for the session.
LOW Symlinks Traverse Outside Repository with Developer Path Disclosure -10 ▶
Four symlinks in skills/linkedin-post/evals/fixtures/reference-good/ point to absolute macOS paths on the developer's machine. On macOS during normal plugin operation, these symlinks would attempt to traverse outside the installed plugin directory. Also leaks developer username 'shezmalik' and local project structure.
LOW Hook-Invoked Shell Scripts on Every LinkedIn Publish -5 ▶
hooks/hooks.json registers PreToolUse and PostToolUse hooks that execute shell scripts (pre-publish-policy.sh, post-publish.sh) automatically on every invocation of the LinkedIn MCP publish tools. The scripts run with the agent's filesystem permissions and are not sandboxed.
LOW Autonomous Weekly Batch Posting Mode -10 ▶
Mode A (--weekly-batch) runs on a Monday scheduled job and drafts 3-5 LinkedIn posts automatically. While user approval is required at publish time, the research, drafting, and critique loop runs fully autonomously. The persona-refiner further modifies persona.md across sessions without per-change approval.
INFO Clean Installation — No Unexpected Network or Process Activity 0 ▶
Git clone connected only to github.com (140.82.121.4:443) as expected. No unexpected DNS queries, no outbound connections to third-party endpoints, no process spawning outside the standard git subprocess chain.
INFO Canary Files Accessed Pre-Clone — Likely Audit Framework Baseline 0 ▶
Auditd PATH records show .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and gcloud credentials accessed at 1787685140.149-261, approximately 5 seconds before the git clone at 1787685145.661. Timing and context suggest this is the audit framework's own baseline check, not skill-initiated access. Monitoring system confirms all canary files intact.