Reddit Karma Scanner
Security checks across malware telemetry and agentic risk
Overview
The SKILL.md describes a Node-based Reddit scanner that needs Reddit and OpenAI credentials, but the package contains no code and the registry metadata lists no required env — the pieces don't line up and you should not hand over secrets or run anything from this skill as-is.
Do not export or provide Reddit or OpenAI credentials to this skill as delivered. The README (SKILL.md) asks for sensitive environment variables and for you to run Node scripts, but the package contains only the instructions — the actual scripts are missing. Before using anything: (1) ask the author for the full source repository and verify the code matches the SKILL.md; (2) review the referenced scripts yourself (or have them audited) before running; (3) prefer using limited-scope OAuth tokens or throwaway accounts rather than your primary credentials; (4) run any untrusted code in an isolated environment (VM/container) and do not set long-lived credentials in a global shell; (5) be aware the workflow encourages automated posting and generated comments — this can violate Reddit rules and lead to account suspension. If the author cannot provide verifiable source code and a clear trust path, treat the skill as untrusted and avoid installing or supplying secrets.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings