Back to skill
Skillv1.0.0
ClawScan security
Reddit Research But Free · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 2, 2026, 10:48 PM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code, instructions, and requirements are coherent with a Reddit research CLI: it needs no credentials, uses public JSON endpoints (plus community archives), and only writes a local cache/watchlist.
- Guidance
- This skill appears to do exactly what it claims: query Reddit and two community archives and present results. Before installing, consider: (1) queries sent to PullPush and Arctic Shift are sent to third‑party services (so search terms and returned data go to those sites); (2) running via `npx tsx` may cause a one‑time npm package fetch if `tsx` isn't present locally; (3) the skill writes a local cache (data/cache) and a watchlist file in the skill folder — review or move that folder if you need different storage; and (4) if you require strict flow control, review the small codebase (api.ts, cache.ts, reddit.ts) — it is short and readable. If those points are acceptable, the skill is coherent with its stated purpose.
Review Dimensions
- Purpose & Capability
- okThe name/description (Reddit research, zero auth) match the code and runtime instructions. The skill only requires Node 18+ and uses old.reddit.com JSON plus two community archive providers for historical/deleted content — these are consistent with the stated purpose. Minor note: the CLI is run via `npx tsx` (no npm install recommended), which relies on the tsx runtime being available or fetched via npx at execution time, but that is an implementation detail rather than a mismatch of purpose.
- Instruction Scope
- okSKILL.md instructs the agent to run the provided CLI commands, query Reddit/third‑party archives, and optionally cache or save results. It does not instruct the agent to read unrelated host files, request unrelated credentials, or exfiltrate data to unexpected endpoints. The heartbeat/watchlist instruction to run `watchlist check` is within the monitoring scope described.
- Install Mechanism
- noteThere is no formal install spec (instruction-only), and all code is included in the skill. However, runtime usage assumes `npx tsx` to execute TypeScript files — if `tsx` is not already available, npx may fetch it from the npm registry at runtime. This is a normal convenience pattern but does imply a network fetch of an npm package on first run if the environment doesn't already have `tsx`.
- Credentials
- okThe skill declares no required environment variables or credentials and the code does not attempt to read hidden credentials. It writes/reads only to the skill's own data directory (data/cache, data/watchlist.json). The only network targets are old.reddit.com, api.pullpush.io, and arctic-shift.photon-reddit.com — all directly related to the stated data providers.
- Persistence & Privilege
- okalways:false (no forced persistent inclusion) and the skill does not modify other skills or system-wide agent settings. It persists only its own cache and watchlist files under the skill directory.