Reddit Market Insights

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a coherent Reddit market-research skill, but it relies on a third-party MCP/npm package and API key that users should verify before use.

Before installing, verify the reddit-insights-mcp package and Reddit Insights service, use a dedicated revocable API key, and avoid sending confidential product or business information in search queries.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing the MCP server may run third-party code on the user's machine as part of enabling the Reddit search tools.

Why it was flagged

The setup instructs users to install and run an external npm MCP package that is not included or version-pinned in the skill artifacts. This is purpose-aligned but should be verified.

Skill content
"command": "npx", "args": ["-y", "reddit-insights-mcp"]
Recommendation

Verify the npm package and publisher, consider pinning a known-good version, and install only from trusted sources.

What this means

Users may have less clarity about the exact package identity or publishing lineage.

Why it was flagged

The packaged _meta.json identity differs from the registry presentation for this evaluated skill, which is a provenance inconsistency rather than direct evidence of harmful behavior.

Skill content
"ownerId": "kn75tqwb2jdzpb5v70vqxe4gcx803c3j", "slug": "reddit-insights", "version": "1.2.0"
Recommendation

Confirm the skill identity, owner, and intended version before installing, especially because the runtime depends on an external MCP package.

What this means

Anyone with access to the local MCP configuration could potentially see or misuse the API key.

Why it was flagged

The skill requires a Reddit Insights API key in MCP configuration, although the registry requirements list no required env vars or primary credential. The credential use is expected for the service integration.

Skill content
"REDDIT_INSIGHTS_API_KEY": "your_api_key_here"
Recommendation

Use a dedicated, revocable API key, keep it out of shared files, and rotate it if the configuration is exposed.

What this means

Market-research queries, category ideas, and other prompts may be sent to the Reddit Insights service.

Why it was flagged

The skill routes user research queries through an external MCP/service provider. This is central to the skill's purpose but creates an external data boundary.

Skill content
Research ecommerce categories on Reddit ... using semantic AI search via reddit-insights.com MCP server.
Recommendation

Avoid including confidential business plans, unreleased product details, or sensitive customer data in search queries unless the provider's privacy terms are acceptable.