Back to skill

Security audit

Scavio Reddit

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Reddit research helper that sends user-directed Reddit queries to Scavio and does not show hidden or destructive behavior.

Before installing, understand that Reddit search terms, post IDs, subreddit names, usernames, and similar request parameters will be sent to Scavio using your API key and may consume credits. Do not use it with secrets, confidential investigation terms, or personal data unless that external service use is acceptable for your workflow.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill sends user-supplied queries and receives content through a third-party service (Scavio), but the description and guidance do not clearly warn users that their prompts, search terms, and retrieved Reddit content are transmitted externally. This creates a privacy and data-governance risk because users may unknowingly send sensitive research topics or internal investigation terms to an outside API.

External Transmission

Medium
Category
Data Exfiltration
Content
HEADERS = {"Authorization": f"Bearer {API_KEY}"}

# 1. Search Reddit
results = requests.post(f"{BASE}/api/v1/reddit/search", headers=HEADERS,
    json={"query": "serpapi alternative"}).json()

post_id = results["data"]["results"][0]["post_id"]
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
post_id = results["data"]["results"][0]["post_id"]

# 2. Full post detail
post = requests.post(f"{BASE}/api/v1/reddit/post", headers=HEADERS,
    json={"post_id": post_id}).json()

# 3. Top comments, then expand one thread
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
json={"post_id": post_id}).json()

# 3. Top comments, then expand one thread
comments = requests.post(f"{BASE}/api/v1/reddit/post/comments", headers=HEADERS,
    json={"post_id": post_id, "sort": "TOP"}).json()

reply_cursor = comments["data"]["comments"][0]["reply_cursor"]
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
json={"post_id": post_id, "sort": "TOP"}).json()

reply_cursor = comments["data"]["comments"][0]["reply_cursor"]
replies = requests.post(f"{BASE}/api/v1/reddit/post/comments/replies", headers=HEADERS,
    json={"post_id": post_id, "cursor": reply_cursor}).json()

# 4. Subreddit feed
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
json={"post_id": post_id, "cursor": reply_cursor}).json()

# 4. Subreddit feed
feed = requests.post(f"{BASE}/api/v1/reddit/subreddit/posts", headers=HEADERS,
    json={"subreddit": "Python", "sort": "TOP"}).json()
```
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:42