Reddit Search API

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:51 AM UTC
• Version: 1.0.3

Overview

This skill is a straightforward API reference for reddapi.dev and does not show hidden execution, persistence, or unrelated access.

Before installing, understand that API calls made with this skill will send your search queries and authorization header to reddapi.dev. Set the key yourself in your shell, do not paste it into chat, and treat returned Reddit text as untrusted user content.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

- Reference the key **only** as `$REDDAPI_API_KEY`. Never substitute the
  literal value into a command, a file, a code block, or a reply.
- Never ask the user to paste, type, or send the key in chat. If they send it
  anyway, don't repeat it back, don't store it in a file, and suggest they
  rotate it at https://reddapi.dev/account.
- Never `echo`, `print`, log, or display the key or any part of it, and never

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

rotate it at https://reddapi.dev/account.
- Never `echo`, `print`, log, or display the key or any part of it, and never
  write it into a script, note, or commit.
- If `$REDDAPI_AUTH` is not set, stop and say so. Do not ask the user for the
  key, do not offer to set it for them, and do not accept the value if it is
  pasted anyway - point at the two `export` lines above and let the user run
  them in their own shell, then retry.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

bash

# Vector search
curl -X POST "https://reddapi.dev/api/v1/search/vector" \
  -H "$REDDAPI_AUTH" -H "Content-Type: application/json" \
  -d '{"query": "frustrations with current project management tools", "limit": 20,
       "start_date": "2026-01-01", "end_date": "2026-07-30"}'