Reddit Api

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:24 AM UTC
• Version: 1.1.0

Overview

The skill is mostly transparent and read-only, but its MCP schema contradicts the rest of the package about authentication for paid API calls and the package has stale verification metadata.

Install only if you are comfortable sending Reddit lookup terms, usernames, post IDs, and permalinks to ReplyNodes and spending prepaid credits on successful reads. For MCP use, treat all six data endpoints as requiring Bearer authentication despite the schema field, keep REPLYNODES_API_KEY in a secret store, and do not run any missing validation script found from an unverified source.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/reddit-api-mcp.schema.json:82

Finding

Priced MCP Operations Are Incorrectly Marked as Not Requiring Authentication

Content

View full analysis

Remediation

View remediation

other

Note

• Location: INSTALL.md:9

Finding

Installation Guide References an Absent Validation Script

Content

View full analysis

Remediation

View remediation

other

Note

• Location: CHECKSUMS.txt:13

Finding

Integrity Metadata References an Artifact Missing from the Package

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (35)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · PROVENANCE.md (reported line 4)May include surrounding context.

md

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 12)May include surrounding context.

md

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

md

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

md

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

md

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · llms.txt (reported line 5)May include surrounding context.

text

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/endpoints.md (reported line 3)May include surrounding context.

md

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/endpoints.md (reported line 13)May include surrounding context.

md

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/endpoints.md (reported line 54)May include surrounding context.

md

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/endpoints.md (reported line 69)May include surrounding context.

md

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/endpoints.md (reported line 85)May include surrounding context.

md

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/endpoints.md (reported line 105)May include surrounding context.

md

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/endpoints.md (reported line 122)May include surrounding context.

md

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/endpoints.md (reported line 138)May include surrounding context.

md

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/reddit-api-mcp.schema.json (reported line 14)May include surrounding context.

json

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/scenarios.md (reported line 16)May include surrounding context.

md

# Endpoint reference

Base URL: `https://api.replynodes.com/v1/reddit`

All seven routes below are the complete public surface. Nothing else is
documented or supported; do not invent additional routes or parameters.

Static analysis

No suspicious patterns detected.