{"data":{"skill":{"slug":"ralyodio-linkedin-easy-apply","name":"linkedin-easy-apply","icon":"📦","repo":"https://github.com/ralyodio/agent-skills/tree/main/skills/linkedin-easy-apply-automation","status":"approved","author":"ralyodio","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"38a40bf2-bad7-4de9-93fd-f8e28269206d","skill_id":"e6b9b745-11ec-4920-bc86-d52467a66a9f","version":1,"content_hash":"6c8ac62c215aad0b875225a0a13bc4c7","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Skill is a documentation/guide template for building LinkedIn Easy Apply automation. Static scanner flagged 48 potential issues but most are false positives from code examples in documentation. Confirmed legitimate browser automation patterns. Primary concerns are (1) LinkedIn Terms of Service violations for automated job applications, (2) pattern detection for Puppeteer/Chrome flags including --disable-setuid-sandbox which is a standard Chrome launch option. Skill explicitly avoids credential storage and includes conservative answer guardrails.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":59,"line_start":49},{"file":"SKILL.md","line_end":63,"line_start":59},{"file":"SKILL.md","line_end":69,"line_start":63},{"file":"SKILL.md","line_end":82,"line_start":69},{"file":"SKILL.md","line_end":88,"line_start":82},{"file":"SKILL.md","line_end":90,"line_start":88},{"file":"SKILL.md","line_end":99,"line_start":90},{"file":"SKILL.md","line_end":100,"line_start":99},{"file":"SKILL.md","line_end":102,"line_start":100},{"file":"SKILL.md","line_end":104,"line_start":102},{"file":"SKILL.md","line_end":132,"line_start":104},{"file":"SKILL.md","line_end":132,"line_start":132},{"file":"SKILL.md","line_end":132,"line_start":132},{"file":"SKILL.md","line_end":137,"line_start":132},{"file":"SKILL.md","line_end":144,"line_start":137},{"file":"SKILL.md","line_end":148,"line_start":144},{"file":"SKILL.md","line_end":151,"line_start":148},{"file":"SKILL.md","line_end":157,"line_start":151},{"file":"SKILL.md","line_end":166,"line_start":157},{"file":"SKILL.md","line_end":172,"line_start":166},{"file":"SKILL.md","line_end":172,"line_start":172}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":100,"line_start":100}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":69,"line_start":69},{"file":"SKILL.md","line_end":52,"line_start":52},{"file":"SKILL.md","line_end":149,"line_start":149},{"file":"SKILL.md","line_end":150,"line_start":150},{"file":"SKILL.md","line_end":164,"line_start":164},{"file":"SKILL.md","line_end":165,"line_start":165}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":68,"line_start":68},{"file":"SKILL.md","line_end":69,"line_start":69},{"file":"SKILL.md","line_end":68,"line_start":68},{"file":"SKILL.md","line_end":69,"line_start":69}]},{"factor":"scripts","evidence":[{"file":"SKILL.md","line_end":82,"line_start":63}]}],"critical_findings":[],"high_findings":[{"title":"LinkedIn Terms of Service Violation Risk","locations":[{"file":"SKILL.md","line_end":175,"line_start":21}],"confidence":0.85,"description":"Automated job application submissions likely violate LinkedIn's Terms of Service. Users risk account suspension or legal action from LinkedIn. This is a business/legal risk rather than technical security risk.","confidence_reasoning":"Skill is explicitly designed to automate LinkedIn Easy Apply, which LinkedIn prohibits. Line 42 mentions stopping for CAPTCHA but does not address ToS compliance."}],"medium_findings":[{"title":"Chrome Security Flags Misidentified","locations":[{"file":"SKILL.md","line_end":71,"line_start":71}],"confidence":0.9,"description":"Static scanner flagged --disable-setuid-sandbox as UID/GID manipulation. This is a standard Chrome launch flag for containerized environments, not malicious UID manipulation.","confidence_reasoning":"The --disable-setuid-sandbox flag is documented Chromium behavior for running in Docker containers. No actual UID/GID changes occur."},{"title":"Code Examples Flagged as External Commands","locations":[{"file":"SKILL.md","line_end":172,"line_start":49}],"confidence":0.92,"description":"Static scanner detected backtick execution patterns in code examples. These are documentation examples, not actual executions in the skill.","confidence_reasoning":"All external command detections are in code blocks showing example Puppeteer/JavaScript patterns. Skill is a documentation template, not executable code."}],"low_findings":[{"title":"Environment Variable Access for Configuration","locations":[{"file":"SKILL.md","line_end":59,"line_start":49}],"confidence":0.88,"description":"Skill uses environment variables for configuration (RESUME_PDF, CHROME_PROFILE, STATE_DIR). This is standard configuration pattern, not credential exposure.","confidence_reasoning":"Environment variables are documented configuration values, not secrets. Line 25 explicitly states skill contains no credentials."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":175,"audit_model":"claude","audited_at":"2026-04-30T12:27:27.176+00:00","created_at":"2026-04-30T13:33:06.019426+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":4,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}