ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Reddit Researcher

v1.0.0

Scan Reddit for posts matching keywords and summarize findings. Uses Bing primary + Reddit JSON API fallback — robust against DuckDuckGo bot blocking. Use wh...

⭐ 0· 53·0 current·0 all-time
by@kryzl19·duplicate of @kryzl19/reddit-researcher-agent
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
ℹ
Purpose & Capability
The name/description match the code: scripts search the web/Reddit, fetch posts, and produce summaries. However, registry metadata lists no required env vars while SKILL.md requires REDDIT_KEYWORDS and optional REDDIT_SUBREDDITS/REDDIT_SEARCH_ENGINE. SKILL.md says cache is in ~/.openclaw/... but the scripts use a local ../cache directory. These inconsistencies mean the metadata and docs are not fully aligned with the actual capability.
ℹ
Instruction Scope
Runtime instructions and scripts operate within the stated scope: they perform network searches (Bing/DuckDuckGo/Reddit), fetch Reddit JSON, extract titles/comments, and write local cache and export files. They do not attempt to read other user files or transmit data to unexpected third-party endpoints. Caveats: the scripts invoke additional system tools (python3, md5sum, stat -c, grep -P, cut, wc) that are not declared; some commands (stat -c, grep -P) are platform-specific and may fail on non-Linux hosts.
✓
Install Mechanism
No install spec (instruction-only) and included scripts are simple shell/Python one-liners. Risk is low from an installer perspective, but the scripts will write cache and export files into directories relative to the skill and the user's filesystem.
ℹ
Credentials
The skill does not request secrets or cloud credentials (no TOKENS/KEYS). However, SKILL.md requires REDDIT_KEYWORDS (required) and uses REDDIT_SUBREDDITS/REDDIT_SEARCH_ENGINE, yet the registry metadata did not list these env vars—an inconsistency. Also the scripts set custom User-Agent headers when querying external services (benign but notable).
✓
Persistence & Privilege
The skill is not always-enabled and does not modify other skills or global agent configuration. It caches fetched pages to a local cache directory and writes export markdowns; that is standard and limited in scope.
What to consider before installing
What to consider before installing: - Functional fit: The scripts do match a 'Reddit researcher' purpose — they query search engines and Reddit, then summarize posts. - Mismatched metadata/docs: The registry lists no required env vars or binaries, but SKILL.md and the scripts expect REDDIT_KEYWORDS (required) and may use REDDIT_SUBREDDITS/REDDIT_SEARCH_ENGINE. The skill's documented cache path (~/.openclaw/...) does not match the actual ./cache directory used by the scripts. Ask the author to reconcile metadata and documentation before trusting automatic installs. - Undeclared dependencies: The scripts call python3, md5sum, stat (with -c), and rely on grep -P and other GNU-specific flags. Ensure these binaries exist on your system or run in a sandboxed environment. The registry only declared curl; that is insufficient. - Networking & scraping: The skill will make outbound requests to Bing, DuckDuckGo (html.duckduckgo.com), and reddit.com. If you or your org restricts outgoing traffic or forbids scraping, do not run it. Also be aware of Reddit's terms of service concerning automated scraping. - Files written: The skill caches responses and writes export markdown files. If you run this on sensitive hosts, confirm where files are written and review cache contents. - Practical steps: Review/patch the SKILL.md to declare REDDIT_KEYWORDS and required binaries, test the scripts locally in a disposable/sandbox environment, and ensure rate limits/robots policy are acceptable. If you need higher assurance, ask the publisher for an updated release that fixes metadata, documents dependencies (python3, coreutils), and clarifies cache paths. Given the inconsistencies (metadata vs. actual scripts and undeclared binaries) I recommend exercising caution (review and test manually) rather than installing blindly.

Like a lobster shell, security has layers — review code before you run it.

latestvk9748e5gmeeqvv0xazgvnc144n83mkzd

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

Binscurl

Comments