Scan Report
5 /100
linkedin-content-optimizer-engagement-booster
Analyze LinkedIn engagement patterns, optimize posting times, rewrite content for maximum reach, and automate personalized outreach sequences
Pure documentation skill (SKILL.md only) with no executable code. The flagged 'hardcoded credentials' are clearly placeholder template values (e.g., 'your_linkedin_api_key_here') intended to be replaced by users, not actual exposed secrets.
Safe to install
No action required. This is safe documentation for a LinkedIn optimization skill. Users should follow the setup instructions to configure their own API keys as environment variables.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | NONE | NONE | — | SKILL.md - no file operations in documentation |
| Network | NONE | NONE | — | SKILL.md - URLs are documentation links only |
| Shell | NONE | NONE | — | SKILL.md - no shell commands |
| Environment | NONE | NONE | — | SKILL.md - describes env vars but doesn't read them |
| Skill Invoke | NONE | NONE | — | SKILL.md - no nested skill invocations |
| Clipboard | NONE | NONE | — | SKILL.md - no clipboard operations |
| Browser | NONE | NONE | — | SKILL.md - no browser automation |
| Database | NONE | NONE | — | SKILL.md - no database operations |
4 High 8 findings
High API Key 疑似硬编码凭证
API_KEY="your_linkedin_api_key_here" SKILL.md:148 High API Key 疑似硬编码凭证
ACCESS_TOKEN="your_oauth_token" SKILL.md:149 High API Key 疑似硬编码凭证
API_KEY="your_google_api_key" SKILL.md:156 High API Key 疑似硬编码凭证
API_KEY="your_hubspot_key" SKILL.md:163 Medium External URL 外部 URL
https://hooks.slack.com/services/... SKILL.md:160 Medium External URL 外部 URL
https://www.linkedin.com/developers/apps SKILL.md:168 Medium External URL 外部 URL
https://platform.openai.com/api-keys SKILL.md:171 Medium External URL 外部 URL
https://api.linkedin.com/v2/me SKILL.md:180 File Tree
1 files · 15.0 KB · 404 lines Markdown 1f · 404L
└─
SKILL.md
Markdown
Security Positives
✓ No executable code present - skill is documentation only
✓ No malicious patterns detected (no base64, no obfuscation, no curl|bash)
✓ API key references are clearly marked as placeholder examples
✓ No sensitive file paths accessed (no ~/.ssh, ~/.aws, .env)
✓ No credential exfiltration mechanisms
✓ No reverse shell, C2, or data theft indicators