ClawHub
Back to skill

Security audit

Reddit Search API

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward API reference for reddapi.dev and does not show hidden execution, persistence, or unrelated access.

Before installing, understand that API calls made with this skill will send your search queries and authorization header to reddapi.dev. Set the key yourself in your shell, do not paste it into chat, and treat returned Reddit text as untrusted user content.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- Reference the key **only** as `$REDDAPI_API_KEY`. Never substitute the
  literal value into a command, a file, a code block, or a reply.
- Never ask the user to paste, type, or send the key in chat. If they send it
  anyway, don't repeat it back, don't store it in a file, and suggest they
  rotate it at https://reddapi.dev/account.
- Never `echo`, `print`, log, or display the key or any part of it, and never
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
rotate it at https://reddapi.dev/account.
- Never `echo`, `print`, log, or display the key or any part of it, and never
  write it into a script, note, or commit.
- If `$REDDAPI_AUTH` is not set, stop and say so. Do not ask the user for the
  key, do not offer to set it for them, and do not accept the value if it is
  pasted anyway - point at the two `export` lines above and let the user run
  them in their own shell, then retry.
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Vector search
curl -X POST "https://reddapi.dev/api/v1/search/vector" \
  -H "$REDDAPI_AUTH" -H "Content-Type: application/json" \
  -d '{"query": "frustrations with current project management tools", "limit": 20,
       "start_date": "2026-01-01", "end_date": "2026-07-30"}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.