ClawHub
Back to skill

Security audit

Reddit Ads

Security checks across malware telemetry and agentic risk

Overview

This Reddit Ads skill is mostly inspection-focused but clearly discloses that connected tools can make confirmed live campaign changes.

Install only if you are comfortable connecting a Reddit Ads account through ClawLink. Treat it as capable of both reporting and campaign management: review every preview carefully, and approve write actions only when the account, resource, and spend impact match what you intended.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The skill is marketed primarily as an inspection and review capability, but the workflow explicitly enables write actions including create, update, pause, launch, edit, and delete operations against live ad resources. That mismatch can cause users or downstream agents to invoke the skill with a read-only trust model while actually being exposed to spend-affecting or destructive actions, increasing the risk of unauthorized or accidental changes.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The documentation creates an internal contradiction by presenting the skill as an inspection tool while later instructing the agent to execute update and other write operations. This ambiguity is dangerous in an agent setting because policy, user expectation, and automation logic may treat the skill as low-risk/read-only when it can actually modify live campaigns and affect spend.

VirusTotal

51/51 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.