B — Some risk signals Graded October 16, 2026Minor concerns worth a quick check.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
AI agent skill · Developer tools
linkedin-skills
Claude skills for LinkedIn. 12 Claude Code and Codex skills that write human-sounding LinkedIn posts, craft comments that get noticed, analyze your feed, and build a publishing cadence, all from your terminal. Content engineering by Creative Content Crafts. MIT.
Bottom line: Signal-based grade (4/7 points): well starred on GitHub, listed in several sources, public source code. This reflects adoption and transparency, not a code review.
- Popularity score
- 47/100
- Rank
- #169 of 500
- GitHub stars
- 4.8k
What it does
Provides 12 Claude skills for LinkedIn workflow automation, including post generation, comment crafting, feed analysis, and publishing cadence planning—all executable from the terminal. Designed to help users produce human-sounding content and optimize engagement through AI-assisted content engineering.
Who it’s for
LinkedIn power users, content strategists, and builders who want to automate LinkedIn workflows within Claude or terminal environments. Executives seeking to scale social presence without manual drafting.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Verify against the repo README at https://github.com/sergebulaev/linkedin-skills (opens external site) for the most current setup. Likely involves cloning the repo and configuring Claude skills or MCP connector credentials; exact install steps should be confirmed directly from documentation.
Risks
- Credential scope: Requires LinkedIn API or session credentials; overly broad permissions could expose account to unauthorized posting or data access.
- Prompt injection: User inputs to post generation or comment crafting could be exploited to produce unintended content or manipulate LinkedIn engagement metrics.
- Account lockout: Automated posting/engagement may trigger LinkedIn's rate-limiting or spam detection, risking account suspension.
- Data exfiltration: Feed analysis could expose personal network data or private messaging if permissions are misconfigured.
- Supply-chain trust: Tool maintained by third party (Creative Content Crafts); updates or dependency changes could introduce vulnerabilities.
How to stay secure
Least-privilege permissions
- Use LinkedIn API tokens with minimal scopes; request only "r_liteprofile" and "w_member_social" — never grant full account access or messaging permissions
- Create a dedicated LinkedIn service account with posting-only privileges instead of using your primary account credentials
- Rotate API tokens monthly and revoke unused keys immediately; store credentials in a secrets manager (HashiCorp Vault, AWS Secrets Manager) rather than environment variables
Network isolation
- Run the skill in an isolated environment or container (Docker) with no direct internet access except to LinkedIn API endpoints
- Implement egress filtering to allow only authenticated HTTPS traffic to
api.linkedin.comand block redirect/callback attempts to unknown domains - Disable skill access from shared machines or CI/CD pipelines; restrict execution to controlled, audited workstations only
Monitoring
- Log all post/comment generation attempts with timestamps, user inputs, and generated content; flag any output containing URLs, contact info, or suspicious keywords
- Set up alerts for rate-limit errors (HTTP 429) and account lockout warnings; pause automation immediately if thresholds are exceeded
- Audit LinkedIn API access logs weekly for unauthorized scopes or sessions; cross-reference with your terminal history and skill invocation logs
Red flags to watch for
- Generated content that differs significantly from your voice, contains promotional links, or solicits engagement artificially — manually review before publishing
- Sudden permission requests (e.g., messaging, profile editing) or dependency updates to the skill without documented changelog
- LinkedIn notifications about unusual login locations, failed authentication attempts, or comments/posts you don't recognize
Alternatives
- LinkedIn Official API + custom automation (native, higher control, stricter rate limits)
- Buffer, Hootsuite, or Later (commercial social schedulers with LinkedIn integration and compliance review)
- Zapier + LinkedIn connectors (no-code automation, limited but safer scope)
- Manual Claude prompts in Claude.ai (lower risk, higher friction, no terminal integration)