Reddit社区数据采集

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:59 AM UTC
• Version: 3.6.1

Overview

This Reddit data skill needs review because it uses a sensitive MaxHub API key and contains non-Reddit fallback endpoint instructions despite presenting itself as Reddit-only.

Review before installing. Use a pinned and verified installer version, keep `MAXHUB_API_KEY` out of logs and prompts, and only allow calls you expect to `https://www.aconfig.cn/api/v1/reddit/*`; the non-Reddit fallback instructions should be removed or ignored before trusting this as a Reddit-only skill.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:15

Finding

Unpinned npm CLI Package Execution in English Installation Guide

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 15-17
Vulnerability Type: Supply-chain risk caused by executing an unpinned npm package
Risk Level: Medium

Complete Code Snippet:

bash

npx clawhub install maxhub-reddit

Technical Analysis

The installation guide invokes clawhub through npx without specifying a package version, lockfile, or integrity hash. If the package is not available locally, npx can retrieve and execute the version currently resolved by the npm registry.

This makes the executed installation code mutable after the Skill has been reviewed. The safety of the command consequently depends on the ongoing integrity of the npm package, its publisher account, and its dependency tree. The repository provides no mechanism for ensuring that users execute the same reviewed CLI release.

Attack Path

1. An attacker compromises the npm publisher account for clawhub, compromises one of its dependencies, or otherwise causes a malicious version to be resolved.
2. A user follows the installation command in README.md.
3. npx downloads the currently resolved, unpinned package version.
4. Package lifecycle logic or the CLI entry point executes with the privileges of the user running the command.
5. The malicious package can perform arbitrary actions available to that user before or during Skill installation.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the installing user's privileges. Depending on the host environment and user permissions, the malicious package could read user-accessible files and environment variables, steal credentials, alter local configuration, install modified Skill content, access network resources, or tamper with other user-owned files.

The command does not inherently grant administrative privileges, so the direct scope is limited to the permissions of the invoking user. The impact may nevertheless b ...[truncated 168 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a specifically reviewed release:

   bash

   npx clawhub@<verified-version> install maxhub-reddit
   

2. Verify and document the expected package publisher, registry, release provenance, and checksum or integrity metadata.
3. Prefer a trusted, already installed local CLI where operationally practical, and provide instructions for verifying its version before use.
4. Use lockfiles and reproducible dependency resolution in automated installation environments.
5. Disable or carefully review dependency lifecycle scripts where the package manager and workflow permit it.
6. Run installation with an unprivileged account and avoid exposing unrelated credentials or sensitive environment variables to the installer.

T08 · Insecure Dependencies

Warning

• Location: README_CN.md:15

Finding

Unpinned npm CLI Package Execution in Chinese Installation Guide

Content

View full analysis

Vulnerability Details

File Location: README_CN.md, lines 15-17
Vulnerability Type: Supply-chain risk caused by executing an unpinned npm package
Risk Level: Medium

Complete Code Snippet:

bash

npx clawhub install maxhub-reddit

Technical Analysis

The localized installation guide invokes clawhub through npx without pinning a version or supplying an integrity constraint. When the package is not already installed locally, npx can retrieve and execute the package version currently selected by the npm registry.

Because the resolved package may change after this Skill is audited, users are not guaranteed to execute a reviewed installer. Security therefore depends on the continuing integrity of the package publisher, registry, transitive dependencies, and future releases.

Attack Path

1. An attacker publishes or causes resolution of a malicious clawhub version through publisher compromise, registry compromise, or dependency-chain compromise.
2. A user follows the installation command in README_CN.md.
3. npx retrieves the mutable, unpinned package release.
4. The package's lifecycle scripts or CLI code run under the invoking user's account.
5. Malicious code performs actions within that account's local and network permissions.

Impact Assessment

Exploitation could result in arbitrary code execution with the privileges of the user performing installation. Potential consequences include access to user-readable credentials and files, environment-variable theft, local configuration changes, installation of modified Skill content, outbound data transmission, and tampering with development or automation resources.

No automatic privilege escalation is demonstrated by the command itself. The attainable scope is determined by the invoking account, but it can include highly sensitive assets if installation is performed as an administrator or inside a CI/CD environment.

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable invocation with an explicitly reviewed version:

   bash

   npx clawhub@<verified-version> install maxhub-reddit
   

2. Keep the pinned version synchronized across all localized documentation.
3. Publish verification instructions covering package ownership, release provenance, and integrity metadata.
4. Use reproducible dependency resolution and lockfiles in automated environments.
5. Prefer execution through a trusted local installation after validating its exact version.
6. Perform installation under least privilege and remove unrelated secrets from the process environment.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (26)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The metadata and description present the skill as Reddit-only, but the execution guidance includes behavior for other platforms and endpoint families. A misleading capability declaration can cause operators and downstream agents to overtrust the skill and unknowingly send requests outside the intended platform scope.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 91% confidence

Finding

The duplicate finding points to the same hidden-instruction mechanism: the skill directs behavior based on hidden comment metadata rather than visible, user-reviewable content. This can be abused to smuggle endpoint-routing or fallback logic past normal review and increases the likelihood of unintended API access.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

| 禁止行为 | 正确做法 |
|----------|----------|
| ❌ 自行拼接路径（如 `/api/v1/douyin/search/xxx`） | ✅ 使用 Action Table 或 `<!-- Full path: -->` 中的路径 |
| ❌ 猜测参数名（如把 `aweme_id` 写成 `video_id`） | ✅ 使用 Action Table 或 reference 文件中的参数名 |
| ❌ 假设 v1/v2/v3 参数兼容 | ✅ 降级时重新读取对应版本的参数文档 |
| ❌ 调用 `fetch_hot_search_list` 或 `app/v3/fetch_video_comments` | ✅ 使用替代端点（见废弃标注） |

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 91% confidence

Finding

The duplicate finding points to the same hidden-instruction mechanism: the skill directs behavior based on hidden comment metadata rather than visible, user-reviewable content. This can be abused to smuggle endpoint-routing or fallback logic past normal review and increases the likelihood of unintended API access.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md

| 禁止行为 | 正确做法 |
|----------|----------|
| ❌ 自行拼接路径(如 `/api/v1/douyin/search/xxx`) | ✅ 使用 Action Table 或 `<!-- Full path: -->` 中的路径 |
| ❌ 猜测参数名(如把 `aweme_id` 写成 `video_id`) | ✅ 使用 Action Table 或 reference 文件中的参数名 |
| ❌ 假设 v1/v2/v3 参数兼容 | ✅ 降级时重新读取对应版本的参数文档 |
| ❌ 调用 `fetch_hot_search_list` 或 `app/v3/fetch_video_comments` | ✅ 使用替代端点(见废弃标注) |

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly asserts that all endpoints are legitimate read-only Reddit APIs, yet elsewhere contains downgrade rules and examples for unrelated Douyin/Xiaohongshu endpoints. This mismatch undermines trust boundaries and can cause an agent to access unintended third-party APIs under a false safety framing, increasing risk of scope creep and misrouted data handling.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

md

| "analyze" / "分析一下" | Switch to analyze mode |
| "compare with X" / "和X对比" | Add X as second query |

## Output Guidelines

1. **Language consistency** — ALL output matches user's detected language.
2. **Markdown links** — All URLs in `[text](url)` format.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 11)May include surrounding context.

md

`GET /api/v1/reddit/app/fetch_community_highlights`

<!-- Full path: /api/v1/reddit/app/fetch_community_highlights -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 79)May include surrounding context.

md

`GET /api/v1/reddit/app/fetch_post_details`

<!-- Full path: /api/v1/reddit/app/fetch_post_details -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 121)May include surrounding context.

md

`GET /api/v1/reddit/app/fetch_post_details_batch`

<!-- Full path: /api/v1/reddit/app/fetch_post_details_batch -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 166)May include surrounding context.

md

`GET /api/v1/reddit/app/fetch_post_details_batch_large`

<!-- Full path: /api/v1/reddit/app/fetch_post_details_batch_large -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-post.md (reported line 212)May include surrounding context.

md

`GET /api/v1/reddit/app/fetch_subreddit_post_channels`

<!-- Full path: /api/v1/reddit/app/fetch_subreddit_post_channels -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-subreddit.md (reported line 11)May include surrounding context.

md

`GET /api/v1/reddit/app/fetch_games_feed`

<!-- Full path: /api/v1/reddit/app/fetch_games_feed -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-subreddit.md (reported line 75)May include surrounding context.

md

`GET /api/v1/reddit/app/fetch_news_feed`

<!-- Full path: /api/v1/reddit/app/fetch_news_feed -->

### Parameters

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/api-user-search.md (reported line 11)May include surrounding context.

md

`GET /api/v1/reddit/app/fetch_comment_replies`

<!-- Full path: /api/v1/reddit/app/fetch_comment_replies -->

### Parameters

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The installation command uses npx clawhub without pinning a specific version, which means users may execute whatever package version is current at install time. If the package is compromised, typo-squatted, or a malicious update is published, this can lead to arbitrary code execution on the user's machine during installation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The listed example prompts are single generic words like "帖子", "详情", "版块", "社区", "用户", and "搜索", which overlap with common everyday conversation and do not clearly distinguish when this skill should activate. The README also does not provide constraints, exact trigger scope, or negative examples to prevent accidental invocation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to run npx clawhub install maxhub-reddit without pinning an exact package version. This can cause users to execute whatever version is current at install time, which expands supply-chain risk if the package is later compromised, replaced, or updated with unsafe behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file instructs the assistant to determine and maintain the response language from the user's language, and later states that all output must match the detected language. This forces a language/locale choice based on detection rather than offering the user a choice or requiring explicit opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The skill is designed to transmit user-derived query parameters and an authorization bearer token to an external service. External transmission is expected for API skills, but it remains security-relevant because users may unknowingly send sensitive query content off-platform and the skill lacks explicit minimization or domain/path enforcement beyond documentation.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

maxhub_auth_header="Authorization: Bearer ${MAXHUB_API_KEY}"

# GET example
curl -s "https://www.aconfig.cn/api/v1/reddit/{endpoint}?{params}" \
  -H "$maxhub_auth_header"

# POST example

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The prohibition table references Douyin-specific paths and behaviors inside a Reddit skill, which is inconsistent with the declared scope and pairs poorly with later non-Reddit fallback logic. This kind of mixed instruction set can confuse automated routing and lead to unintended endpoint selection or policy bypass through ambiguous documentation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger tables use very broad signals such as "info," "find," "show me," and "analyze" without clear exclusion conditions or negative examples. In a markdown skill description, this can cause the skill to match common everyday requests rather than narrowly scoped Reddit-data intents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation explicitly instructs use of a bearer token in the Authorization header but provides no guidance on secure handling, storage, rotation, or redaction of that credential. In an agent-skill context, this increases the chance that downstream agents or users may log, echo, hardcode, or otherwise mishandle the API key, leading to credential exposure and unauthorized API use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 62% confidence

Finding

The file presents substantial content bilingually but does not state whether users may choose a preferred language or whether Chinese is required by policy. Because locale/language constraints should be opt-in or clearly justified, this creates a mild natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document instructs use of a Bearer API key and an external base URL but does not warn that prompts, parameters, and credentials are being sent to a third-party service. In an agent skill context, that omission can cause users or orchestrators to transmit sensitive data without informed consent, increasing privacy and secret-handling risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The file presents headings, parameter descriptions, and usage notes in both Chinese and English, but it does not state whether the bilingual format is intentional, user-selectable, or required for a specific locale. Under SQP-3, language policy issues can arise when a skill imposes language conventions without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file documents an endpoint that retrieves detailed user profile information including account creation time, karma, images, bio, verification status, awards, and follower counts. Under the markdown-specific SQP-2 criteria, the description omits any warning that the operation involves collecting third-party profile data that may raise privacy considerations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.