Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Reddit research helper that sends queries to the disclosed reddapi.dev service, with no hidden code, persistence, or unrelated local access found.
Install only if you are comfortable sending Reddit research queries, dates, and related parameters to reddapi.dev under that service's terms. Avoid putting secrets, customer data, internal strategy, regulated personal data, or confidential product plans into search prompts; use explicit Reddit-scoped requests when invoking it.
The description explains the capability but does not clearly warn that user queries will be sent to reddapi.dev, an external third-party API. Users may provide confidential product ideas, internal research topics, or sensitive business questions without realizing they are being transmitted outside the local agent environment.
The trigger list includes very broad phrases such as 'market research', 'user feedback', and 'what do people think about', which can cause the skill to activate for generic requests well beyond a clearly bounded Reddit-search use case. That increases the chance that users' prompts are routed to this third-party service unexpectedly, leading to unnecessary external disclosure of research topics or sensitive business context.
This endpoint sends user-provided natural-language queries to an external service for semantic processing and AI summarization. In this skill's context, queries are likely to contain product strategy, competitive analysis, pain points, or other sensitive research prompts, so undisclosed transmission creates privacy and confidentiality risk.
AI-powered semantic search with keyword extraction, vector search, and AI summary generation.
curl -X POST "https://reddapi.dev/api/v1/search/semantic" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query": "What do developers think about Rust vs Go for backend services?", "limit": 20}'
The vector search example also transmits raw user search terms and optional date filters to reddapi.dev. Although it avoids LLM summarization, it still exports potentially sensitive research interests or internal business concerns to a third party, so the core confidentiality issue remains.
Fast vector similarity search. No LLM processing, returns results in seconds.
curl -X POST "https://reddapi.dev/api/v1/search/vector" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query": "best productivity apps for ADHD", "limit": 30, "start_date": "2026-01-01", "end_date": "2026-03-18"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Get trending topics from Reddit based on post engagement.
curl -X POST "https://reddapi.dev/api/v1/trends" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"start_date": "2026-03-11", "end_date": "2026-03-18", "limit": 20}'
This workflow example explicitly sends a market-research query about frustrations with project management tools to the third-party API. Because the skill is marketed for idea validation and competitive research, users are especially likely to submit commercially sensitive prompts, making external transmission more dangerous in context.
Market Research:
curl -X POST https://reddapi.dev/api/v1/search/semantic \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query": "frustrated with project management tools switching from Jira", "limit": 50}'
No suspicious patterns detected.