ClawHub
Back to skill

Security audit

Reddit Search API

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Reddit API reference skill with disclosed API-key handling and no hidden execution, persistence, or destructive behavior.

Before installing, understand that this skill is for using reddapi.dev and may consume that service's API quota when you run the provided curl requests. Keep the API key in your shell environment as instructed and do not paste it into chat.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- Reference the key **only** as `$REDDAPI_API_KEY`. Never substitute the
  literal value into a command, a file, a code block, or a reply.
- Never ask the user to paste, type, or send the key in chat. If they send it
  anyway, don't repeat it back, don't store it in a file, and suggest they
  rotate it at https://reddapi.dev/account.
- Never `echo`, `print`, log, or display the key or any part of it, and never
Confidence
80% confidence
Finding
Never ask the user

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
rotate it at https://reddapi.dev/account.
- Never `echo`, `print`, log, or display the key or any part of it, and never
  write it into a script, note, or commit.
- If `$REDDAPI_AUTH` is not set, stop and say so. Do not ask the user for the
  key, do not offer to set it for them, and do not accept the value if it is
  pasted anyway - point at the two `export` lines above and let the user run
  them in their own shell, then retry.
Confidence
80% confidence
Finding
Do not ask the user

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.