How we test LinkedIn extensions
We don't take the vendor's word for it. We download the real, published extension, restore its code into something readable, and follow your LinkedIn session through it — line by line. Every verdict in this checker traces back to something we can point at in the code. Here is exactly how we do it, walked through on one real tool.
Two honest ways to know what a tool does
There are only two honest ways to find out what an automation tool really does with your LinkedIn account: ask the vendor, or read the code. Marketing pages tell you what a tool is for. The code tells you what it does. So we read the code.
For this project we took the actual extensions of 16 popular LinkedIn tools — the same packages anyone installs from the Chrome Web Store — and analysed them without ever logging into LinkedIn. No accounts at risk, no guesswork: just the shipped code, read carefully, with the receipts attached.
The eight things we check
For every tool we answer the same eight questions, in order of how much they matter:
- 1Does your LinkedIn session leave your computer? The single most important one.
- 2Does it talk to LinkedIn the way a browser does, or take shortcuts?
- 3Does it inject its own buttons and code into the LinkedIn page?
- 4Does it try to block LinkedIn’s own tracking? (Counter-intuitively, a giveaway.)
- 5Is it on LinkedIn’s built-in list of known extensions?
- 6Does it fake clicks and keystrokes?
- 7Does one download hide several different designs behind your plan?
- 8How much access does it ask for, and where can your data flow?
The first question carries most of the weight, so we'll spend the most time on it.
Waalaxy, step by step
Waalaxy is a good tool to learn the method on, because it does almost everything we look for — so following one tool teaches you the whole process.
We download the real extension
We install Waalaxy's published Chrome Web Store package — the identical files every user gets. Nothing custom, nothing leaked: the product as shipped. We note its version and the exact day we took the snapshot, because tools update and our findings describe the version we read.
We make the code readable
Shipped extension code is compressed into one dense, unreadable blob to save space. We restore it to a readable form — re-spaced and laid out — so we can follow it like a normal program. We can't recover the developers' original names for things, so we read what the code does, not what they called it.
We follow your session (the step that matters most)
This is the heart of every audit. Your LinkedIn login lives in a small piece of data called a session cookie (li_at is the important one) — whoever holds it can act as you. So the only question that matters is: does the tool just read that cookie, or does it send it somewhere? Reading a cookie proves nothing. We judge a tool entirely by where the cookie's value actually ends up.
In Waalaxy's code, we found it collecting the entire LinkedIn cookie jar — your li_at login and everything alongside it — and then uploading that bundle to its own servers. From that moment, Waalaxy's cloud holds your LinkedIn login and can operate your account from its own datacenter address, from another country, even when your browser is closed. This is the highest-risk design there is — your one login, live on two different IP addresses at the same time — and it isn't optional in Waalaxy: it's how the cloud features work.
Contrast that with the safer design we've seen in other tools: the extension reads data inside your browser and uploads only the results — your login never leaves. Same starting permission (“reads cookies”); completely different outcome. The only way to tell them apart is to follow the value, which is what we do.
We check how it talks to LinkedIn
A real LinkedIn page, when you open a profile, fires a whole flock of supporting requests around the action. A tool that calls LinkedIn's internal machinery directly — firing only the bare action request without the page around it — produces an unnatural pattern that's visible in LinkedIn's own server logs. Waalaxy makes a large number of these direct internal calls, so we record that.
We look at what it puts on the page, and what it tries to hide
We check whether the tool injects its own panels and buttons into the LinkedIn page (Waalaxy injects a sidebar and several buttons across LinkedIn), because anything injected leaves a trace LinkedIn can scan for. We also check whether the tool tries to block LinkedIn's tracking — and Waalaxy strips out one of LinkedIn's tracking headers. This is self-defeating: to hide successfully you'd have to block everything LinkedIn watches, and missing one means the survivor reports that the rest went quiet. The silence is itself the anomaly. Finally we note faked clicks: automation clicks carry a built-in “this wasn't a real human” flag that an extension cannot switch off.
We check LinkedIn's own scan list
LinkedIn ships a hardcoded list of known extensions in its own page code and quietly checks, on every visit, whether each one is installed — so for these tools, having it installed is visible before you click anything. We look up each extension against that list. Waalaxy is on it: LinkedIn probes for one of Waalaxy's own bundled files on every page load, and a hit flags the account. (This is the same list this checker tests you against — 6,153 entries in the current snapshot.)
We map it to the three detection systems
Finally we line our findings up against the three cooperating systems LinkedIn runs in its own pages — independently documented, line by line, by the BrowserGate investigation:
- The extension scanner probes its known-extensions list — and Waalaxy is on it (Step 6).
- The page scanner sweeps the page for any extension's traces and needs no list at all — and Waalaxy injects into the page (Step 5).
- The device fingerprint — 48 characteristics of your machine, attached to every request — is something a cloud acting as you from its own server cannot reproduce, which is exactly the exposure Waalaxy's session upload creates (Step 3).
On top of those sits a behavioral layer that watches volume and how you act — and Waalaxy ships no enforced daily limit, which leaves that layer entirely up to the user.
One tool, every major detection vector — which is why it's the example we chose.
How we stay honest
Three rules keep these write-ups trustworthy:
- 1.Every claim points at the code. If we can't show it in what the tool actually does, we soften it or drop it. We say “we found this in the code,” not “this will get you banned.”
- 2.What happens on a vendor's servers, we mark “highly likely” — never as fact. We can read what leaves the extension; we cannot see inside someone else's cloud. So when we say a cloud “likely replays your session through LinkedIn's internal API,” that likely is deliberate and stays.
- 3.It's a score, not a single tripwire. Each finding adds risk toward a restriction; none of it is an instant ban. We never call any tool “safe” or “undetectable” — including Linked Helper, the tool we recommend.
What this method can and can't tell you
- It reads the code as shipped on the day we looked. Vendors update; a later version can behave differently, and our findings name the version we read.
- It sees only the extension — not the vendor's servers. Everything that happens after your session reaches their cloud is informed inference, marked “highly likely.”
- It covers the extension form of a tool. Pure cloud services that never ship an extension are a separate kind of investigation.
- LinkedIn's known-extensions list is one of three detection systems, and it's a snapshot that grows by roughly a dozen entries a day. “Not on the list” is never the same as “undetectable.”
Do it yourself in five minutes
You don't need to be a security researcher for a first-pass check. Unpack any extension, then look for the one thing that matters: a place where your LinkedIn login cookie is read and then sent to a vendor's address. If you find your li_at travelling to a vendor domain, that isn't “integration” — that's your session leaving home. (To watch LinkedIn's own scan run: open linkedin.com with developer tools, watch the network for its telemetry requests on reload, or search the page's code for chrome-extension://.)
Get 20% off Linked Helper + a free trial.
The one tool we tore down that isn't a browser extension at all — so it leaves LinkedIn the smallest surface to detect.