storyagent_linkedin

Interact with LinkedIn via Unipile API - send messages, view profiles, manage connections, create posts, react to content. Use when the user asks to message someone on LinkedIn, check LinkedIn messages, view LinkedIn profiles, send connection requests, create LinkedIn posts, or interact with LinkedIn content.

Before installing or running this skill: (1) Recognize it requires UNIPILE_DSN and UNIPILE_ACCESS_TOKEN (the registry metadata fails to declare them) — treat those as sensitive credentials that grant API access to act on your LinkedIn accounts. (2) Verify the skill source/author and whether you trust the Unipile service and the unipile-node-sdk npm package (supply-chain risk). (3) Prefer creating a least-privileged or revocable token on Unipile (short-lived or scoped) rather than using a long-lived master token. (4) Avoid placing tokens in shared workspace files; store them in a secure secret store or ephemeral environment. (5) If you plan to run the CLI, run npm install in an isolated environment and inspect installed packages. (6) If uncertain about provenance or if the metadata mismatch concerns you, treat installation as risky and either ask the publisher for corrected metadata or run the tool in a sandboxed environment.

Type: OpenClaw Skill Name: unipile-linkedin Version: 1.0.0 The skill is designed to interact with LinkedIn via the Unipile API, as stated in `SKILL.md` and `README.md`. The core script, `scripts/linkedin.mjs`, uses the `unipile-node-sdk` to perform all LinkedIn operations and retrieves API credentials (`UNIPILE_DSN`, `UNIPILE_ACCESS_TOKEN`) from environment variables, which is standard practice. There is no evidence of prompt injection, unauthorized file system access, arbitrary command execution, or data exfiltration to unapproved endpoints. The `resources/last_50_posts.json` file contains only public sample data. All observed behaviors are aligned with the stated purpose.