Skills/PyPI/mcp-server-linkedin

mcp-server-linkedin@4.29.0

VERIFIED· not started

Publisher claims: "MCP server that gives AI assistants like Claude access to LinkedIn profiles, companies, and job postings through the user's own browser session." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher stickerdaniel · publishing for 286 daysInstalls 68,344Last detonated 5d ago
$claude mcp add mcp-server-linkedin -- uvx mcp-server-linkedin
WatchReport an issue

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
no credential variables read in the code
Where it talks to
linkedin.com (its own)
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it under the guard. Not started: dependency install failed; the server itself was not observed. The code names no credential variable and talks to linkedin.com, its own; the guard pins the network to what the honeypot saw and logs every call.

$vet-skills run --net declared -- uvx mcp-server-linkedin

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-09 and scored it 81/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

HIGH
Collapsed <details> block carrying instructionsREADME.md:359 · Collapsed <details> block carrying instructions<summary>Told to run <code>--login</code> on the host when you already did</summary> - If tool calls answer "No valid LinkedIn session is available in Docker" oFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Credential pass-through configurationtests/test_browser_driver.py:1267 · Credential pass-through configuration — agent relays sensitive credentialsWrong proxy credentials produce no proxy error code: Chromium retries theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Python subprocess execution detectedtests/test_ci_scope.py:89 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL with embedded credentialstests/test_config.py:941 · URL with embedded credentials — may be phishing or credential leakingconfig = BrowserConfig(proxy_server=f"http://user:{self.SECRET}@gate:7000")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Collapsed <details> block carrying instructionsREADME.md:279 · Collapsed <details> block carrying instructions<summary>Told to run <code>--login</code> on the host when you already did</summary> - If tool calls answer "No valid LinkedIn session is available in Docker" oFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedtests/test_bootstrap.py:7137 · Python subprocess execution detectedrun = subprocess.run([sys.executable, "-c", script], capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL with embedded credentialstests/test_bootstrap.py:5620 · URL with embedded credentials — may be phishing or credential leaking"https://ci-bot:s3cr3t@[email protected]/x.zip",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
URL with embedded credentialstests/test_config.py:975 · URL with embedded credentials — may be phishing or credential leaking"proxy_server": "http://u:p@host:8080",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
URL with embedded credentialstests/test_bootstrap.py:4878 · URL with embedded credentials — may be phishing or credential leakingurl = "https://ci-bot:[email protected]/chromium.zip"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_cli_main.py:1366 · MCP server using network transport (SSE/HTTP) — data sent over network"linkedin_mcp_server.daemon.owner.direct_http_client",Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detectedtests/test_ci_scope.py:59 · Python subprocess execution detectedcompleted = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL with embedded credentialstests/test_config.py:1040 · URL with embedded credentials — may be phishing or credential leakingmonkeypatch.setenv("PROXY_SERVER", f"http://envuser:{self.SECRET}@gate:7000")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_ci_scope.py:133 · MCP server using network transport (SSE/HTTP) — data sent over network"plugins/linkedin-mcp-server/assets/icon.svg",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST04
MEDIUM
Python subprocess execution detectedtests/test_bootstrap.py:8414 · Python subprocess execution detectedcompleted = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL with embedded credentialstests/test_bootstrap.py:3800 · URL with embedded credentials — may be phishing or credential leaking"sitecustomize: https://ci-bot:[email protected]/p?key=s3cr3t working\n"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Collapsed <details> block carrying instructionsREADME.md:251 · Collapsed <details> block carrying instructions<summary>Session issues</summary> - Browser profile is stored at `~/.linkedin-mcp/profile/` - Managed browser downloads are cached at `~/.linkedin-mcp/patchrighFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
URL with embedded credentialstests/test_browser_driver.py:1395 · URL with embedded credentials — may be phishing or credential leaking"failed via http://acctzone9:[email protected]:7000"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
URL with embedded credentialstests/test_bootstrap.py:5614 · URL with embedded credentials — may be phishing or credential leaking"https://ci-bot:[email protected]/x.zip",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Collapsed <details> block carrying instructionsREADME.md:332 · Collapsed <details> block carrying instructions<summary>Login issues</summary> - Make sure you have only one active LinkedIn session at a time - LinkedIn may require a login confirmation in the LinkedIn mobiFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
URL with embedded credentialstests/test_config.py:951 · URL with embedded credentials — may be phishing or credential leakingconfig = BrowserConfig(proxy_server="http://user:p%40ss@gate:7000")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Collapsed <details> block carrying instructionsREADME.md:260 · Collapsed <details> block carrying instructions<summary>Login issues</summary> - Make sure you have only one active LinkedIn session at a time - LinkedIn may require a login confirmation in the LinkedIn mobiFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
URL with embedded credentialstests/test_bootstrap.py:3721 · URL with embedded credentials — may be phishing or credential leakingb"sitecustomize: https://user:[email protected]/x?token=secret\x1b[2J\n"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Collapsed <details> block carrying instructionsREADME.md:351 · Collapsed <details> block carrying instructions<summary>Use your own Chrome</summary> - Set **Chrome executable** in the extension's settings to a Chrome, Chromium or Chrome for Testing binary, such as `/usrFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedtests/test_daemon_pilot.py:156 · Python subprocess execution detectedchild = subprocess.Popen([sys.executable, "-c", ""])Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_core_browser.py:728 · Python subprocess execution detectedprocess = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_daemon_auth.py:909 · MCP server using network transport (SSE/HTTP) — data sent over network``create_mcp_server`` assembles it, with a backend whose election finds theFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detectedtests/test_daemon_proxy.py:4759 · Python subprocess execution detectedself.process = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandtests/test_core_browser.py:1111 · Process kill command — agent can terminate processesgroup and kill it, so the launch was left running *and* the profile markedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtests/test_core_imports.py:15 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandtests/test_daemon_election.py:1647 · Process kill command — agent can terminate processesf"stopping the child took {max(stopping):.1f}s, and a kill it "Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Credential pass-through configurationtests/test_config.py:1222 · Credential pass-through configuration — agent relays sensitive credentials"""A username with an empty password is a legitimate proxy credential.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Process kill commandtests/test_docker_image.py:742 · Process kill command — agent can terminate processesnon-zero. ``kill -0`` keeps succeeding for a zombie, which is why waitingFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandtests/test_docker_image.py:643 · Process kill command — agent can terminate processesserver_term = _ENTRYPOINT.index('kill -TERM "$server_pid"')Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandtests/test_docker_image.py:572 · File permission modification command — agent changes file ownership/permissionsassert 'sudo chown -R "$(id -u):$(id -g)" ~/.linkedin-mcp' in documentFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedtests/test_daemon_liveness.py:1046 · Python subprocess execution detectedstarted = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_daemon_lock.py:51 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
HTTP URL with a raw public IP addresstests/test_core_destination.py:98 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot name("http://192.0.2.1:8080/login#x", "http://192.0.2.1:8080"),Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_daemon_liveness.py:1118 · MCP server using network transport (SSE/HTTP) — data sent over networkfrom linkedin_mcp_server.daemon.owner import direct_async_http_clientFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detectedtests/test_daemon_election.py:4826 · Python subprocess execution detectedfrontend = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_docker_image.py:176 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# suffix and a nested directory, which is the whole of what `**/.env*` claims.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Privileged sudo commandtests/test_docker_image.py:572 · Privileged sudo command — agent may execute with elevated privilegesassert 'sudo chown -R "$(id -u):$(id -g)" ~/.linkedin-mcp' in documentFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtests/test_daemon_election.py:1809 · Python subprocess execution detected"grandchild = subprocess.Popen([sys.executable, '-c', "Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandtests/test_daemon_proxy.py:4878 · Process kill command — agent can terminate processes# the run, so the kill lands on a call that has acted.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
URL using a raw public IP addresstests/test_core_destination.py:98 · URL using a raw public IP address — may bypass domain-based filtering("http://192.0.2.1:8080/login#x", "http://192.0.2.1:8080"),Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/test_docker_image.py:249 · Python subprocess execution detectedlisting = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_daemon_election.py:3204 · Python subprocess execution detectedchild = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_daemon_startup.py:897 · Python subprocess execution detected"subprocess.run([sys.executable, '-c', \"print('stray grandchild')\"])\n"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_core_browser.py:716 · Python subprocess execution detectedstate = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandtests/test_daemon_election.py:2025 · Process kill command — agent can terminate processes# kill frontends. Entering obtain_owner here can spawn a detached ownerFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtests/test_daemon_startup.py:904 · Python subprocess execution detectedcompleted = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL with embedded credentialstests/test_core_destination.py:48 · URL with embedded credentials — may be phishing or credential leaking"https://user:[email protected]/feed/",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Python subprocess execution detectedtests/test_docker_image.py:465 · Python subprocess execution detectedif subprocess.run([docker, "info"], capture_output=True, check=False).returncode:Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL with embedded credentialstests/test_core_destination.py:99 · URL with embedded credentials — may be phishing or credential leaking("https://user:[email protected]/block", "https://filter.example"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
HTTP URL with a raw public IP addresstests/test_core_destination.py:78 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot name("http://192.0.2.1/login", True),Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/test_daemon_silence.py:1105 · Python subprocess execution detectedself.process = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL using a raw public IP addresstests/test_core_destination.py:78 · URL using a raw public IP address — may bypass domain-based filtering("http://192.0.2.1/login", True),Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/test_docker_image.py:240 · Python subprocess execution detectedbuild = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandtests/test_daemon_election.py:2062 · Process kill command — agent can terminate processes#: owner's pid and then waits, so the test can kill the owner while this processFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtests/test_daemon_pilot.py:490 · Python subprocess execution detected"subprocess.Popen([sys.executable, sys.argv[1], sys.argv[2]])\n"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandtests/test_daemon_election.py:1643 · Process kill command — agent can terminate processes# this, which is harmless — the second kill finds a dead child —Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtests/test_daemon_election.py:2209 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_daemon_pilot.py:807 · Python subprocess execution detectedowner = subprocess.Popen([sys.executable, "-c", "import time; time.sleep(60)"])Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_docker_image.py:271 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandtests/test_daemon_silence.py:1097 · Process kill command — agent can terminate processes#: process well before, and the bound keeps a missed kill from lasting.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtests/test_docker_image.py:223 · Python subprocess execution detectedprobe = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_debug_trace.py:167 · Python subprocess execution detectedother = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandtests/test_docker_image.py:645 · Process kill command — agent can terminate processesdisplay_term = _ENTRYPOINT.index('kill -TERM "$xvfb_pid"', server_wait)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandtests/test_daemon_election.py:1628 · Process kill command — agent can terminate processes# alone, where it is affordable. A kill and one wait cost 2 to 10msFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtests/test_daemon_election.py:2119 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandtests/test_daemon_lock.py:259 · File permission modification command — agent changes file ownership/permissions# 0755 to 0700. A custom profile directly under /tmp would try to chmodFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
URL with embedded credentialstests/test_config.py:1082 · URL with embedded credentials — may be phishing or credential leakingAppConfig(), ["--proxy-server", f"http://u:{self.SECRET}@h:8080"]Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_daemon_liveness.py:1108 · MCP server using network transport (SSE/HTTP) — data sent over networkfrom linkedin_mcp_server.daemon.owner import direct_async_http_clientFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Process kill commandtests/test_process_tree.py:1306 · Process kill command — agent can terminate processes# Pre-kill check, after the kill, at the first EPERM, at the second.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_docker_image.py:182 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env.example",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_private_state.py:249 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL with embedded credentialstests/test_error_codes.py:121 · URL with embedded credentials — may be phishing or credential leakingf"failed via http://{user}:{secret}@gate.example:7000",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Hidden zero-width characters detectedtests/test_pr_title.py:158 · Hidden zero-width characters detected — may conceal content"",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
Dense URL-encoded contenttests/test_identifiers.py:72 · Dense URL-encoded content — may be obfuscating payloadsvalue = "https://ru.linkedin.com/in/%D0%B0%D0%BD%D0%B4%D1%80%D0%B5%D0%B9"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File permission modification commandtests/test_private_state.py:387 · File permission modification command — agent changes file ownership/permissions# chmod follows a link, so hardening one would set 0600 on whatever itFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandtests/test_process_tree.py:1142 · Process kill command — agent can terminate processesat the end, so neither a verdict bought with another group kill norFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Bidirectional text override characters detectedtests/test_pr_title.py:154 · Bidirectional text override characters detected — may hide content direction"‮",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/test_private_state.py:206 · Python subprocess execution detectedlisting = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandtests/test_private_state.py:813 · File permission modification command — agent changes file ownership/permissions# A share or a FAT volume accepts chmod and keeps the old mode. WithoutFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Access to sensitive file pathstests/test_docker_image.py:184 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env.previous-proxy",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Credential pass-through configurationtests/test_error_handler.py:292 · Credential pass-through configuration — agent relays sensitive credentials"""The catch-all log must not carry proxy credentials.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Hidden zero-width characters detectedtests/test_pr_title.py:171 · Hidden zero-width characters detected — may conceal content"fix: Subject.​",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
Python subprocess execution detectedtests/test_greenlet_runtime.py:368 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_process_tree.py:137 · Python subprocess execution detectedstate = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Bidirectional text override characters detectedtests/test_pr_title.py:153 · Bidirectional text override characters detected — may hide content direction"‪",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Process kill commandtests/test_process_tree.py:215 · Process kill command — agent can terminate processes# scan and its kill could launch a browser the scan never saw.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Hidden zero-width characters detectedtests/test_pr_title.py:169 · Hidden zero-width characters detected — may conceal content"fix: ​",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
Python subprocess execution detectedtests/test_pr_title.py:344 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Hidden zero-width characters detectedtests/test_pr_title.py:170 · Hidden zero-width characters detected — may conceal content"fix(​): Subject",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
Python subprocess execution detectedtests/test_process_tree.py:281 · Python subprocess execution detectedprobe = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Bidirectional text override characters detectedtests/test_pr_title.py:155 · Bidirectional text override characters detected — may hide content direction"⁦",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/test_process_tree.py:306 · Python subprocess execution detectedgate = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Dense URL-encoded contenttests/test_link_metadata.py:962 · Dense URL-encoded content — may be obfuscating payloads"?currentJobId=%D9%A4%D9%A2%D9%A5"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Credential pass-through configurationtests/test_docker_image.py:427 · Credential pass-through configuration — agent relays sensitive credentialssession cookie and proxy credentials; a real build listed it inside `/app`.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Unicode escape sequence detectedtests/test_link_metadata.py:925 · Unicode escape sequence detected — may contain obfuscated payloads"\u0664\u0662\u0665\u0662\u0660\u0662\u0666\u0664\u0669\u0666/"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Access to sensitive file pathstests/test_docker_image.py:181 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_private_state.py:188 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL with embedded credentialstests/test_error_handler.py:491 · URL with embedded credentials — may be phishing or credential leakingshaped = ToolError(f"failed via http://{user}:{secret}@gate.example:7000")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
URL with embedded credentialstests/test_error_handler.py:359 · URL with embedded credentials — may be phishing or credential leakingException(f"failed via http://{user}:{secret}@gate.example:7000"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Python subprocess execution detectedtests/test_private_state.py:226 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandtests/test_login_viewer.py:278 · File permission modification command — agent changes file ownership/permissionsassert "chown -R pwuser:pwuser /opt/patchright" in dockerfileFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Access to sensitive file pathstests/test_docker_image.py:183 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env.local",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_process_tree.py:72 · Python subprocess execution detected"c=subprocess.Popen([sys.executable,'-c','import time; time.sleep(600)']);"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_pr_title.py:427 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_private_state.py:267 · Python subprocess execution detectedlisting = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_installer_worker.py:206 · Python subprocess execution detectedprocess = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_process_tree.py:67 · Python subprocess execution detectedleader = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Dense URL-encoded contenttests/test_identifiers.py:81 · Dense URL-encoded content — may be obfuscating payloadsnormalize_person_identifier("%D0%B0%D0%BD%D0%B4%D1%80%D0%B5%D0%B9")Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Dense URL-encoded contenttests/test_identifiers.py:302 · Dense URL-encoded content — may be obfuscating payloadsassert urlparse(url).path == "/in/%D0%B0%D0%BD%D0%B4%D1%80%D0%B5%D0%B9/"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Process kill commandtests/test_process_tree.py:1302 · Process kill command — agent can terminate processes"""The loaded-macOS shape: the kill landed, waitid has not caught up.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Hidden zero-width characters detectedtests/test_pr_title.py:181 · Hidden zero-width characters detected — may conceal content"fix: ​",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
Bidirectional text override characters detectedtests/test_pr_title.py:156 · Bidirectional text override characters detected — may hide content direction"⁩",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL with embedded credentialstests/test_error_handler.py:310 · URL with embedded credentials — may be phishing or credential leakingException("failed via http://acctzone9:[email protected]:7000"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
File permission modification commandtests/test_private_state.py:244 · File permission modification command — agent changes file ownership/permissions# This ran chmod and read ls once, and that failed open: measured withFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedtests/test_server.py:426 · Python subprocess execution detectedanswered = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL with embedded credentialstests/test_proxy_errors.py:97 · URL with embedded credentials — may be phishing or credential leakingredacted = redact_proxy_credentials("http://user:s3cr3t%20p%40ss@gate:7000")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Python subprocess execution detectedtests/test_release_notes.py:625 · Python subprocess execution detectedanswer = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_release_notes.py:754 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_profile_lease.py:626 · Python subprocess execution detectedholder = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_server.py:391 · Python subprocess execution detectedpulled_in_the_server_graph = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_setup.py:454 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_profile_lease.py:48 · Python subprocess execution detectedreturn subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_towncrier_config.py:35 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandtests/test_session_state.py:305 · Process kill command — agent can terminate processes# #838. A WMI query on CPython 3.12 can kill the process: `_wmi`'s workerFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Credential pass-through configurationtests/test_proxy_errors.py:138 · Credential pass-through configuration — agent relays sensitive credentials"""Rejected proxy credentials, which Chromium reports without naming a proxy."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Python subprocess execution detectedtests/test_server.py:548 · Python subprocess execution detectedanswered = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_ruff_toolchain.py:92 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_release_notes.py:126 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL with embedded credentialstests/test_tools.py:434 · URL with embedded credentials — may be phishing or credential leakingshaped = ToolError("Proxy refused http://acctzone9:[email protected]:7000")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Process kill commandtests/test_process_tree.py:1376 · Process kill command — agent can terminate processes"""EPERM on the first kill means no SIGKILL reached the leader."""Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtests/test_release_notes.py:90 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL with embedded credentialstests/test_proxy_errors.py:376 · URL with embedded credentials — may be phishing or credential leakingredacted = redact_proxy_credentials(f"http://{self.USERNAME}:pw@gate:7000")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
URL with embedded credentialstests/test_throttle.py:326 · URL with embedded credentials — may be phishing or credential leakingRuntimeError(f"failed via http://{user}:{secret}@gate.example:7000"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Python subprocess execution detectedtests/test_release_notes.py:668 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈76 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcp-server-linkedin@4.29.0 as of 5d ago. This is the package itself, not its dependencies.