ClawHub
Back to skill

Security audit

Reddit Leads

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Reddit lead-search helper that uses a third-party API and gives appropriate guardrails for credentials and outreach.

Before installing, be comfortable with using public Reddit discussions for prospecting and review Reddit/platform policies and privacy expectations. Keep the API key in your shell environment only, and review any drafted outreach yourself before sending it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
87% confidence
Finding
This markdown skill prominently markets finding and scoring Reddit users for B2B sales outreach, including competitor poaching, but does not provide a user-facing warning about the privacy or reputational risks of using public social content for prospecting. Under SQP-2 for markdown files, behaviours that can affect user privacy should include explicit warnings, even if the underlying data is public.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- Reference the key **only** as `$REDDAPI_API_KEY`. Never substitute the literal
  value into a command, a file, a code block, or a reply.
- Never ask the user to paste, type, or send the key in chat. If they send it
  anyway, don't repeat it back, don't store it in a file, and suggest they rotate
  it at https://reddapi.dev/account.
- Never `echo`, `print`, log, or display the key or any part of it, and never write
Confidence
80% confidence
Finding
Never ask the user

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
it at https://reddapi.dev/account.
- Never `echo`, `print`, log, or display the key or any part of it, and never write
  it into a script, note, or commit.
- If `$REDDAPI_AUTH` is not set, stop and say so. Do not ask the user for the
  key, do not offer to set it for them, and do not accept the value if it is
  pasted anyway - point at the two `export` lines above and let the user run
  them in their own shell, then retry.
Confidence
80% confidence
Finding
Do not ask the user

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.