LinkedIn CLI

A bird-like LinkedIn CLI for searching profiles, checking messages, and summarizing your feed using session cookies.

Security Scan

The skill's code, declared requirements, and runtime instructions are coherent with its stated purpose (a CLI that uses LinkedIn session cookies); nothing requests unrelated credentials or installs unexpected tooling — but the necessary use of session cookies is sensitive and should be handled carefully.

Purpose & Capability

Name/description (LinkedIn CLI) match the actual behavior: the script is a Python CLI that uses LinkedIn session cookies to call LinkedIn via the third‑party linkedin-api library. Required binary (python3) and the two cookie env vars (li_at and JSESSIONID) are proportional to that purpose.

Instruction Scope

SKILL.md instructs users to extract li_at and JSESSIONID from browser DevTools and set them as environment variables — this is consistent with how cookie-based authentication works, but it is sensitive: the instructions require copying session cookies (which grant account access). The instructions do not tell the agent to read unrelated files or exfiltrate data to other endpoints; the code only calls LinkedIn via the linkedin-api library.

Install Mechanism

No install spec (instruction-only) and a small dependency requirement (pip install linkedin-api). This is low-risk for the skill bundle itself; however, installing third‑party Python packages is a normal risk vector — users should vet the linkedin-api package and its source before installing.

Credentials

Only the two cookie env vars (LINKEDIN_LI_AT, LINKEDIN_JSESSIONID) are required and they directly map to the stated cookie-based auth. That is proportionate, but both variables are effectively account credentials and present a high-sensitivity risk if leaked or stored in shared environments.

Persistence & Privilege

Skill does not request permanent presence (always: false), does not modify other skill or system configs, and does not request extra privileges beyond reading two environment variables at runtime.

Assessment

This skill is internally consistent, but it requires sensitive session cookies — treat them like passwords. Before installing or running: - Only run the code locally on a trusted machine; inspect scripts/lk.py yourself (it’s short and readable). - Vet the linkedin-api Python package (source repository, recent commits, maintainers) before pip installing. - Avoid pasting li_at/JSESSIONID into chat, logs, or shared shells; use ephemeral shell sessions or a dedicated automation account. - Understand these cookies grant access to your LinkedIn account; consider using an API/OAuth flow or a separate account for automation where possible. - If you stop using the skill, rotate/revoke the session cookies (log out of LinkedIn or change password) to invalidate them. If you want, I can summarize exactly where the script uses the cookies and point out which lines you should review in more detail.

LinkedIn CLI (lk)

A witty, punchy LinkedIn CLI inspired by the bird CLI. It uses session cookies for authentication, allowing for automated profile scouting, feed summaries, and message checks without a browser.

Setup

1. Extract Cookies: Open LinkedIn in Chrome/Firefox.
2. Go to DevTools (F12) -> Application -> Cookies -> www.linkedin.com.
3. Copy the values for li_at and JSESSIONID.
4. Set them in your environment:

   export LINKEDIN_LI_AT="your_li_at_value"
   export LINKEDIN_JSESSIONID="your_jsessionid_value"
   

Usage

• lk whoami: Display your current profile details.
• lk search "query": Search for people by keywords.
• lk profile <public_id>: Get a detailed summary of a specific profile.
• lk feed -n 10: Summarize the top N posts from your timeline.
• lk messages: Quick peek at your recent conversations.
• lk check: Combined whoami and messages check.

Dependencies

Requires the linkedin-api Python package:

pip install linkedin-api

Authors

• Built by Fido 🐶