reddapi

What to consider before installing and using this skill: - Metadata mismatch: The documentation clearly requires REDDAPI_API_KEY for Authorization, but the skill metadata does not declare any required environment variables or primary credential. Ask the publisher or maintainer to update the metadata to explicitly declare REDDAPI_API_KEY (and specify expected scopes/permissions). - Unknown source/homepage: The skill has no source repository or homepage. Prefer skills that provide a source repo or homepage so you can inspect code, check who maintains it, and verify claims. - Least privilege for API keys: If you decide to use it, create a dedicated reddapi.dev API key with minimal permissions and rotate/delete it after testing. Do not reuse high-privilege keys (e.g., keys tied to billing or other services). - Verify the API domain: Confirm reddapi.dev is the intended service, check its TLS certificate and official docs, and review its privacy/retention policy (what it does with queried data and any PII). - Test in a sandbox: Because the skill is instruction-only, it’s low install risk, but you should still test calls from an isolated environment (or with a throwaway key) to observe behavior and responses. - Ask for more transparency: Request a homepage or source code and an explicit metadata update (declaring REDDAPI_API_KEY as a required credential). If the publisher cannot provide those, consider it higher risk and avoid supplying real secrets. Confidence notes: The main reason for a "suspicious" verdict is the clear mismatch between SKILL.md examples (which require an API key) and the registry metadata (which declares none), combined with the lack of a verifiable source or homepage. If the publisher provides a source repo or updates metadata to declare the required credential, this assessment could move to benign (assuming no other issues are found).