ClawHub
Back to skill

Security audit

Reddit Insights

Security checks for vulnerabilities and agentic risk

Overview

This Reddit research skill is mostly coherent, but it needs Review because its helper can send the user's API key to an environment-selected base URL that is not disclosed in the skill instructions.

Before installing, treat this as a third-party API integration that uses your REDDAPI_API_KEY and quota. Only run it in an environment where REDDAPI_BASE_URL is unset or explicitly set to the trusted reddapi.dev host, and avoid using it where untrusted environment variables can influence command execution.

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Tainted flow: 'req' from os.environ.get (line 80, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
req = urllib.request.Request(url, data=data, headers=headers, method=method)
    try:
        with urllib.request.urlopen(req, timeout=TIMEOUT) as resp:
            payload = json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as exc:
        # report status + body only, never the request headers (they hold the key)
Confidence
95% confidence
Finding
The request destination is derived from the environment-controlled REDDAPI_BASE_URL and the same request may include the Authorization bearer token. If an attacker can influence the process environment, they can redirect requests to an attacker-controlled host and capture the API key, making this an SSRF-style credential exfiltration issue rather than a harmless network call.

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill documents use of environment variables, file reads, network access, and shell execution, but does not declare permissions accordingly. This creates a transparency and policy-enforcement gap: an agent or platform may allow execution without surfacing the real capability and trust boundary to users.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The skill description says it searches Reddit posts by meaning, but the documented behavior also includes trends lookup, subreddit enumeration, and subreddit detail retrieval, including unauthenticated public routes. That mismatch can mislead operators and users about what the skill will access and do, reducing informed consent and weakening review controls.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.prompt_injection_instructions

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/test_reddit_insights_skill.py:50

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
SKILL.md:144