ClawHub
Back to skill

Security audit

Reddit Explore

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it runs a local Python helper to search Reddit through Apify, with some normal setup and credential-handling cautions.

Install only if you are comfortable sending Reddit search topics to Apify and using an Apify API token that may consume account credits. Prefer setting APIFY_TOKEN through a protected environment or secret manager, avoid passing it with --token, and consider installing apify-client in a virtual environment with pinned versions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:21
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:21-24
Additional Locations: SKILL.md:40-42, references/apify-setup.md:3-6
Vulnerability Type: Unpinned package installation from a mutable package index
Risk Level: Medium

Vulnerable Code

SKILL.md:21-24:

markdown
## Prerequisites

Before running, verify:

1. **apify-client** is installed: `pip3 install apify-client`

The same installation command appears in references/apify-setup.md:3-6:

markdown
## 1. Install the Python SDK

```bash
pip3 install apify-client
text

### Technical Analysis

The documented command installs the latest version of `apify-client` and its transitive dependencies from the package index configured for `pip`. No reviewed version, lock file, trusted index URL, or package integrity hash is specified.

As a result, the code installed when the skill is set up can differ from the code that was present when the skill was audited. A compromised upstream release, compromised dependency, or package shadowing through a malicious or misconfigured private package index could introduce attacker-controlled installation or runtime code.

Python package installation can invoke package-controlled build backends and subsequently imports the installed package when `reddit_search.py` executes. Therefore, a supply-chain compromise could result in code execution under the account running the installation or script.

### Attack Path

1. An attacker compromises a future `apify-client` release or one of its transitive dependencies, or places a higher-priority package on an index configured by the victim.
2. A user or Agent follows the skill instructions and executes `pip3 install apify-client`.
3. `pip` resolves the mutable, unpinned package version from the configured index.
4. Attacker-controlled package or build code executes during installation or when the package is imported.
5. The malicious code operates w
...[truncated 671 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin apify-client and all transitive dependencies to reviewed versions in a lock file.
  2. Require package hashes, for example by using a hash-locked requirements file with pip install --require-hashes -r requirements.txt.
  3. Explicitly use the trusted Python Package Index or an internally controlled package repository.
  4. Install dependencies inside a dedicated virtual environment rather than the user's global Python environment.
  5. Periodically review and intentionally update dependency versions after security and compatibility testing.
  6. Keep the pinned installation instructions consistent in SKILL.md and references/apify-setup.md.

Example hardened workflow:

bash
python3 -m venv .venv
. .venv/bin/activate
python3 -m pip install --require-hashes -r requirements.txt

T09 · Insecure Skill Coding Practices

Note
Location
scripts/reddit_search.py:14
Finding

API Token Can Be Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/reddit_search.py:14-17
Vulnerability Type: Sensitive credential accepted through a process command line
Risk Level: Low

Vulnerable Code

python
parser.add_argument("--token", help="Apify API token (or set APIFY_TOKEN env var)")
args = parser.parse_args()

token = args.token or os.environ.get("APIFY_TOKEN")

Technical Analysis

The script explicitly supports supplying an Apify API token through the --token command-line argument. Command-line arguments are not an appropriate secret transport mechanism because they can be retained in shell history, captured by command or job telemetry, included in diagnostic logs, or exposed through process-inspection interfaces while the command is running.

The environment-variable alternative documented by the project is safer than a command-line argument, although environment variables must also be protected from logs and untrusted child processes. The vulnerable interface remains available and is advertised in the argument help text.

Exploitation requires an attacker or monitoring system to have access to command histories, process metadata, job logs, or similar local operational records. The issue does not independently grant remote code execution or additional operating-system privileges.

Attack Path

  1. A user invokes the script using a command such as:

    bash
    python3 scripts/reddit_search.py --query "example" --token "apify_api_SECRET"

  2. The complete command is recorded in shell history, captured by automation logs, or remains visible in process metadata while the script runs.

  3. A local user, administrator, support system, telemetry service, or attacker with access to those records obtains the token.

  4. The attacker submits authenticated requests to Apify using the disclosed credential.

  5. The attacker consumes account credits or accesses resources permitted by the token until ...[truncated 534 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the --token argument and its help text.
  2. Read the token from APIFY_TOKEN, a protected configuration file, an operating-system keyring, or a secrets-management service.
  3. If interactive entry is required, use getpass.getpass() so that the token is not echoed or placed in shell history.
  4. Configure the Apify token with the minimum permissions required by the actor.
  5. Avoid printing or logging the token and review automation systems for accidental environment-variable capture.
  6. Rotate the token immediately if it has previously been supplied through command-line arguments or recorded in logs.

A safer implementation would reject command-line token transmission:

python
token = os.environ.get("APIFY_TOKEN")
if not token:
    print(
        "Error: APIFY_TOKEN not found. Set it as an environment variable.",
        file=sys.stderr,
    )
    sys.exit(1)

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill requests access to an environment variable (APIFY_TOKEN) and invokes local code, but it does not declare any explicit tool scope such as permissions or allowed-tools. That weakens least-privilege controls and makes the skill's operational capabilities less transparent to the user or runtime, increasing the chance of unintended secret exposure or overbroad execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to run a Python script that sends the user's query to Apify/Reddit, but it does not clearly warn the user that their prompt content will be transmitted to third-party services. This creates a privacy and data-handling risk, especially if users include sensitive or proprietary topics in the search query.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/apify-setup.md (reported line 14)May include surrounding context.

md
1. Go to [console.apify.com](https://console.apify.com/)
2. Sign up or log in
3. Navigate to **Settings** > **Integrations** > **API Tokens**
4. Create a new token and copy it

## 3. Set the Environment Variable

Static analysis

No suspicious patterns detected.