ClawHub
Back to skill

Security audit

Reddit Lead Prospecting

Security checks across malware telemetry and agentic risk

Overview

This skill is a manual Reddit lead-research helper with disclosed Brave Search use and no evidence of hidden posting, credential theft, persistence, or destructive behavior.

Install only if you are comfortable providing a Brave Search API key and sending prospecting queries to Brave. Manually review generated comments or post templates for accuracy, disclosure, and subreddit rule compliance before using them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The manifest says the skill is for finding leads and generating comments, but this code also generates full Reddit posts, AMAs, case studies, posting-time advice, cross-posting guidance, and operational engagement tactics. That scope expansion materially changes the capability from passive prospecting into coordinated account/content manipulation, which can violate platform policies and mislead operators about what the skill actually does.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill advertises that no Reddit account is needed, yet it includes scoring based on replies, DMs, upvotes, karma, moderation status, and weekly account-performance tracking. This is a deceptive capability mismatch that can encourage account-based outreach and lead tracking while hiding the operational and compliance implications from users.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.