Reddapi

PassAudited by ClawScan on May 8, 2026.

Overview

This is a coherent instruction-only Reddit data API skill, but users should notice it relies on a third-party API key and references a helper script that is not included.

This skill appears benign and purpose-aligned. Before installing, make sure you are comfortable using reddapi.dev as a third-party provider, protect your API key, avoid sending confidential queries, and do not run any referenced helper scripts unless you can verify their source.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

If the API key is exposed or mishandled, someone else could use the user's reddapi.dev account or quota.

Why it was flagged

The skill requires a Bearer API key for reddapi.dev. This is purpose-aligned for a third-party API integration, but users should handle the key as a sensitive credential.

Skill content

**Authentication:** `Authorization: Bearer YOUR_API_KEY`

Recommendation

Use a dedicated reddapi.dev API key with the minimum needed access, store it securely, and avoid pasting it into shared chats or logs.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Research queries, product names, competitor names, or lead-generation prompts may be visible to the third-party API provider.

Why it was flagged

The skill sends user queries to an external third-party provider. That is expected for this skill, but the artifacts do not describe provider retention, logging, or privacy boundaries.

Skill content

**Base URL:** `https://reddapi.dev`

Recommendation

Avoid sending confidential business information unless you trust reddapi.dev's privacy and data-retention practices.

NoteMedium Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If a user obtains and runs a similarly named script from elsewhere, its behavior would not be covered by this package review.

Why it was flagged

The supporting file references a CLI script, but the provided manifest contains only SKILL.md and SUPPORTING.md. There is no evidence of automatic execution, but the referenced helper code is not available for review here.

Skill content

### reddapi-cli.sh
Command-line interface for reddapi.dev API.

```bash
./scripts/reddapi-cli.sh search "productivity tools" --limit 100

Recommendation

Do not run any external reddapi CLI helper unless it comes from a trusted source and you have reviewed what it does.