ClawHub
Back to skill

Security audit

Reddit Api

Security checks for vulnerabilities and agentic risk

Overview

This is a read-only Reddit public-data connector with clear credential handling, though MCP users should correct an auth metadata mismatch before relying on generated bindings.

Install only if you are comfortable creating a ReplyNodes account and storing a prepaid-credit API key for read-only Reddit public-data lookups. For MCP clients, verify or patch the schema so all priced endpoints require Bearer authentication before generating tools from it.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
references/reddit-api-mcp.schema.json:82
Finding
Authenticated MCP Operations Are Incorrectly Marked as Unauthenticated<![CDATA[ ## Vulnerability Details **File Location**: `references/reddit-api-mcp.schema.json`, lines 82, 111, 140, 178, 215, and 246 **Vulnerability Type**: Authentication configuration inconsistency **Risk Level**: Medium The endpoint-level metadata marks all six priced operations as not requiring authentication, although the gateway contract requires a Bearer API key for each operation. ### Vulnerable Code ```json { "endpoint": { "method": "GET", "path": "/v1/reddit/subreddit_posts/{subreddit}", "operation": "subreddit_posts", "auth_required": false } } ``` ```json { "endpoint": { "method": "GET", "path": "/v1/reddit/post_by_id/{id}", "operation": "post_by_id", "auth_required": false } } ``` ```json { "endpoint": { "method": "GET", "path": "/v1/reddit/post_by_permalink", "operation": "post_by_permalink", "auth_required": false } } ``` ```json { "endpoint": { "method": "GET", "path": "/v1/reddit/search_posts", "operation": "search_posts", "auth_required": false } } ``` ```json { "endpoint": { "method": "GET", "path": "/v1/reddit/user_posts/{username}", "operation": "user_posts", "auth_required": false } } ``` ```json { "endpoint": { "method": "GET", "path": "/v1/reddit/user_activity/{username}", "operation": "user_activity", "auth_required": false } } ``` ### Technical Analysis The schema's endpoint-level security metadata contradicts: - The top-level Bearer transport configuration in the same schema. - The embedded schema instructions requiring a Bearer key. - The `manifest.json` capability declarations. - `SKILL.md` and `references/endpoints.md`, which state that all six priced routes require authentication. MCP clients and tool generators may use `auth_required` to decide whether to attach credentials or expose an operation as anonymous. A client that prioritizes endpoint-level metadata can therefore generate an incorrect authe ...[truncated 1944 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Set `"auth_required": true` for: - `reddit_get_subreddit_posts` - `reddit_get_post_by_id` - `reddit_get_post_by_permalink` - `reddit_search_posts` - `reddit_get_user_posts` - `reddit_get_user_activity` 2. Keep `"auth_required": false` only for `reddit_get_capabilities`. 3. Add automated manifest validation that compares each tool's method, path, price, and authentication requirement against `manifest.json`. 4. Add a release test that rejects any priced endpoint whose `auth_required` value is false. 5. Test the schema with representative MCP clients to verify that: - Bearer credentials are attached only to the fixed ReplyNodes HTTPS origin. - No credential is sent to `/capabilities`. - Authentication failures stop rather than retrying unchanged. - Redirects cannot forward the Authorization header to another origin. 6. Correct the related package-integrity inconsistencies before release, including references to the missing validation script, missing OpenAPI file, and missing `skill-card.md`. ]]>

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The manifest includes generic trigger terms such as "setup" and "signup" that are not tightly scoped to Reddit data access. In an agent skill registry, overly broad search terms can cause the skill to be selected for unrelated user requests, increasing the chance that the agent solicits or uses the package's bearer API key in contexts where the user did not intend to invoke this service.

Static analysis

No suspicious patterns detected.