ClawHub
Back to skill

Security audit

Reddit Cli

Security checks across malware telemetry and agentic risk

Overview

This is a small Reddit-reading CLI that openly uses Reddit cookies for authentication, with no evidence of hidden exfiltration or persistence beyond the user’s own shell configuration.

Install only if you are comfortable giving this script live Reddit session cookies. Treat REDDIT_SESSION and TOKEN_V2 like passwords: avoid shared machines, do not commit them, prefer a temporary shell or secret manager over shell startup files, and rotate/log out of Reddit if they may have leaked.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The README explicitly instructs users to copy live Reddit authentication cookies from the browser and persist them in shell startup files, which effectively treats session credentials like reusable API tokens. This is dangerous because session cookies are highly sensitive account credentials; storing them long-term in plaintext environment configuration increases the risk of accidental disclosure, local compromise, shell history leakage, or reuse beyond the intended context.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs users to extract live Reddit session cookies from browser developer tools and store them in shell environment variables, but it does not clearly warn that these are equivalent to account credentials and can enable account takeover if exposed. Storing them in ~/.bashrc increases persistence and risk of accidental disclosure through backups, shell debugging, process inspection in some contexts, or reuse on shared systems.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The request function automatically attaches Reddit authentication cookies to outbound HTTPS requests, but the CLI does not give a clear warning that user-supplied session cookies will be transmitted to reddit.com. This can lead users to unknowingly use sensitive browser session tokens in a third-party script, increasing the risk of account misuse if the script is modified, reused in unsafe environments, or logs/error paths later expose cookie-linked behavior.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.