Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Reddit lead-search helper that calls reddapi.dev with a user-provided API key and does not install code, persist itself, or take outreach actions automatically.
Install only if you intend to use reddapi.dev and are comfortable sending your lead-search queries to that service under your own paid API key. Keep the key in your shell environment, do not paste it into chat, and review any drafted outreach yourself before sending.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
server-side does not exist. Filter client-side on lead_score instead:
curl -s -X POST "https://reddapi.dev/api/v1/leads" \
-H "$REDDAPI_AUTH" \
-H "Content-Type: application/json" \
-d '{"query": "people frustrated with project management tools", "limit": 50}' \
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Reference the key **only** as `$REDDAPI_API_KEY`. Never substitute the literal
value into a command, a file, a code block, or a reply.
- Never ask the user to paste, type, or send the key in chat. If they send it
anyway, don't repeat it back, don't store it in a file, and suggest they rotate
it at https://reddapi.dev/account.
- Never `echo`, `print`, log, or display the key or any part of it, and never write
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
it at https://reddapi.dev/account.
- Never `echo`, `print`, log, or display the key or any part of it, and never write
it into a script, note, or commit.
- If `$REDDAPI_AUTH` is not set, stop and say so. Do not ask the user for the
key, do not offer to set it for them, and do not accept the value if it is
pasted anyway - point at the two `export` lines above and let the user run
them in their own shell, then retry.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Find scored, classified business leads from Reddit discussions.
curl -X POST "https://reddapi.dev/api/v1/leads" \
-H "$REDDAPI_AUTH" \
-H "Content-Type: application/json" \
-d '{"query": "people frustrated with project management tools", "limit": 20}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
server-side does not exist. Filter client-side on lead_score instead:
curl -s -X POST "https://reddapi.dev/api/v1/leads" \
-H "$REDDAPI_AUTH" \
-H "Content-Type: application/json" \
-d '{"query": "people frustrated with project management tools", "limit": 50}' \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Find people ready to switch from your competitor
curl -X POST "https://reddapi.dev/api/v1/leads" \
-H "$REDDAPI_AUTH" \
-H "Content-Type: application/json" \
-d '{"query": "founders looking to switch from Stripe alternatives", "limit": 20}'
No suspicious patterns detected.