Reddit Market Insights

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:21 AM UTC
• Version: 1.0.0

Overview

This is a disclosed Reddit market-research skill, but it asks users to run an unpinned third-party MCP package with an API key, so installation needs review before use.

Before installing, pin reddit-insights-mcp to a reviewed exact version, verify the package source, use a dedicated revocable Reddit Insights API key, and run the MCP server with limited privileges. Avoid sending sensitive health, financial, or personal queries unless you are comfortable sharing them with the external search service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:132

Finding

Unpinned Third-Party MCP Package Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 132-156
Vulnerability Type: Unpinned and automatically executed npm dependency
Risk Level: High

Vulnerable Code

json

{
  "mcpServers": {
    "reddit-insights": {
      "command": "npx",
      "args": ["-y", "reddit-insights-mcp"],
      "env": {
        "REDDIT_INSIGHTS_API_KEY": "your_api_key_here"
      }
    }
  }
}

json

{
  "mcpServers": {
    "reddit-insights": {
      "command": "npx reddit-insights-mcp",
      "env": {
        "REDDIT_INSIGHTS_API_KEY": "your_api_key_here"
      }
    }
  }
}

Technical Analysis

Both documented configurations execute reddit-insights-mcp through npx without specifying an exact package version or verifying package integrity. Consequently, the code executed on a user's computer is determined by the package version resolved from the npm registry at execution time rather than by a version reviewed with this Skill.

The Claude Desktop configuration also supplies the -y option, which automatically accepts package installation and suppresses the normal confirmation prompt. Although this package execution is disclosed as part of setup and there is no evidence that the currently published dependency is malicious, the configuration creates a mutable software supply-chain boundary. A compromised package release, npm publisher account, or package-resolution path could replace the expected MCP implementation with attacker-controlled code.

The API key is passed directly into the spawned package's environment. Any executed package version therefore has direct access to REDDIT_INSIGHTS_API_KEY. As a local process, it also executes with the permissions of the account running the MCP host.

Attack Path

1. An attacker compromises the npm publisher account, package publication process, or another relevant package-resolution component for reddit-insights-mcp.

...[truncated 1496 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the MCP package to a reviewed exact version, for example:

   json

   {
     "command": "npx",
     "args": ["reddit-insights-mcp@1.2.3"]
   }
   

2. Remove -y where practical so installation does not occur without user confirmation.
3. Prefer a controlled installation process using a lockfile and npm integrity metadata rather than downloading a package dynamically whenever the server starts.
4. Verify and document the package's official npm publisher, source repository, release signatures, and expected integrity digest.
5. Run the MCP server in a sandbox or dedicated low-privilege account with narrowly scoped filesystem and network access.
6. Use a dedicated, revocable API key with the minimum required permissions and avoid exposing unrelated secrets to the MCP process.
7. Establish a dependency-update review process that examines release changes before advancing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list includes broad phrases such as gift ideas, what to buy, and product recommendations, which are common in general conversation and can cause accidental invocation. Unintended activation may route unrelated user requests through this skill's tooling and output constraints, increasing the chance of irrelevant external queries, privacy leakage in search prompts, or poor task handling. In an agentic environment, overly broad triggers are effectively a boundary-control weakness.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Forcing Chinese for most output fields without user consent can override user intent and system expectations, which is a policy and control issue rather than a direct exploit. In multi-agent or automated workflows, language forcing may degrade reviewability, cause downstream parsing errors, or conceal risky content from operators expecting another language. The danger is contextual and lower than code-execution issues, but it still creates reliability and governance risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs users to run an MCP server via npx reddit-insights-mcp without pinning an exact package version. That creates a supply-chain risk: a future malicious or compromised package release could be fetched and executed automatically in the user's environment. Because MCP servers execute local code and handle API secrets, the blast radius is materially higher than ordinary documentation drift.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation expands into broad SaaS, health, money, app, and generic research use cases that exceed the declared ecommerce-focused purpose. This scope drift can cause the skill to be invoked in contexts with different risk profiles, including sensitive domains like health, where semantic search output may be misapplied or treated as decision support. Overbroad capability claims also weaken policy boundaries and make unintended tool use more likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.