Reddit Ads CLI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:16 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Reddit Ads reporting helper, but it needs review because it tells agents to globally install an unpinned third-party npm CLI that will handle Reddit Ads OAuth credentials.

Install only after you are comfortable trusting the external `reddit-ads-cli` npm package. Prefer a pinned, locally isolated install, verify the package source and publisher, avoid exposing unrelated environment secrets, and use a least-privilege or short-lived Reddit Ads OAuth token. Treat the skill as handling sensitive ad-account data even though the documented commands are intended for reporting and listing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 27
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

bash

# If the CLI is not installed, install it:
npm install -g reddit-ads-cli

Technical Analysis

The Skill instructs the Agent to install the latest available version of reddit-ads-cli globally from the npm registry. The dependency is not pinned to a reviewed version, protected by a lockfile, or verified against an expected integrity hash. Because the package implementation is not included in this project, its installation-time and runtime behavior cannot be verified by this audit.

npm packages may execute lifecycle scripts during installation. A compromised package release or publisher account could therefore cause arbitrary code to run with the permissions of the user invoking npm. Global installation unnecessarily broadens the package's persistence and availability compared with an isolated, project-local installation.

This risk is especially relevant because the installed CLI is subsequently expected to receive a Reddit OAuth access token through REDDIT_ADS_ACCESS_TOKEN, an explicit credentials path, or ~/.config/reddit-ads-cli/credentials.json.

Attack Path

1. An attacker compromises the npm package, its publisher account, or a dependency used by a newly published version.
2. The Agent follows the Skill instruction and runs npm install -g reddit-ads-cli.
3. npm downloads the latest release rather than a previously reviewed and pinned version.
4. Malicious package code or an npm lifecycle script executes with the invoking user's privileges.
5. The package may inspect local files and environment variables, including Reddit credentials available to the invoking user.
6. The malicious package could exfiltrate credentials, alter user-owned files, or execute additional commands within that user's permission boundary.

Impact A

...[truncated 634 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin reddit-ads-cli to a specifically reviewed version rather than installing the latest release implicitly.
2. Prefer a project-local, isolated installation over a global installation.
3. Use a lockfile and verify the downloaded package against an expected integrity value or trusted signed artifact.
4. Verify that the referenced package name, publisher, repository, and release provenance are official before installation.
5. Disable npm lifecycle scripts during installation with --ignore-scripts when the reviewed package is compatible with that restriction.
6. Run the CLI under a minimally privileged account or sandbox with access limited to the files and network endpoints required for Reddit Ads reporting.
7. Use a short-lived, least-privilege Reddit OAuth token and avoid exposing unrelated secrets in the process environment.
8. Restrict credentials-file permissions to the owning user and avoid logging or printing token contents.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

## Authentication

The CLI requires a Reddit **OAuth access token**. Credentials are resolved in this order:

1. `--credentials <path>` flag (per-command)
2. Environment variable: `REDDIT_ADS_ACCESS_TOKEN`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 284)May include surrounding context.

md

## Authentication

The CLI requires a Reddit **OAuth access token**. Credentials are resolved in this order:

1. `--credentials <path>` flag (per-command)
2. Environment variable: `REDDIT_ADS_ACCESS_TOKEN`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

1. `--credentials <path>` flag (per-command)
2. Environment variable: `REDDIT_ADS_ACCESS_TOKEN`
3. Auto-detected file: `~/.config/reddit-ads-cli/credentials.json`

The credentials file format:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 284)May include surrounding context.

md

1. `--credentials <path>` flag (per-command)
2. Environment variable: `REDDIT_ADS_ACCESS_TOKEN`
3. Auto-detected file: `~/.config/reddit-ads-cli/credentials.json`

The credentials file format:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill is presented as a read-only analytics/reporting tool, but the documented scope includes 'manage custom audiences', which is a state-changing capability. This mismatch can cause an agent or user to invoke the skill with a lower risk assumption than warranted, increasing the chance of unintended modifications to advertising assets.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The sentence labels the CLI as 'read-only', but later documentation states that the report command 'generates performance reports via a POST request'. While POST may still be non-mutating in some APIs, calling the tool read-only while documenting non-GET operations is an intent-level contradiction in the skill documentation.

Content

No source excerpt is available for this finding.