ClawHub
Back to skill

Security audit

Scavio Reddit API

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Reddit data lookup integration that sends requested Reddit queries and identifiers to Scavio, with no hidden persistence or destructive behavior found.

Before installing, confirm you are comfortable sending Reddit search terms, post URLs or IDs, usernames, subreddit names, and comment cursors to Scavio using your API key. Do not use the skill for confidential investigations or sensitive identifiers unless that third-party data sharing is acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly sends user-supplied Reddit queries, post URLs/IDs, subreddit names, and usernames to a third-party service, but it does not clearly warn users that their inputs will be transmitted outside the local agent environment. This creates a privacy and data-handling risk because users may provide sensitive research topics or identifiers without informed consent.

External Transmission

Medium
Category
Data Exfiltration
Content
HEADERS = {"Authorization": f"Bearer {os.environ['SCAVIO_API_KEY']}"}

# 1. Search Reddit
results = requests.post(f"{BASE}/api/v1/reddit/search", headers=HEADERS,
    json={"query": "serpapi alternative"}).json()

post_id = results["data"]["results"][0]["post_id"]
Confidence
91% confidence
Finding
requests.post(f"{BASE}/api/v1/reddit/search", headers=HEADERS, json=

External Transmission

Medium
Category
Data Exfiltration
Content
post_id = results["data"]["results"][0]["post_id"]

# 2. Full post detail
post = requests.post(f"{BASE}/api/v1/reddit/post", headers=HEADERS,
    json={"post_id": post_id}).json()

# 3. Top comments, then expand one thread
Confidence
89% confidence
Finding
requests.post(f"{BASE}/api/v1/reddit/post", headers=HEADERS, json=

External Transmission

Medium
Category
Data Exfiltration
Content
json={"post_id": post_id}).json()

# 3. Top comments, then expand one thread
comments = requests.post(f"{BASE}/api/v1/reddit/post/comments", headers=HEADERS,
    json={"post_id": post_id, "sort": "TOP"}).json()

reply_cursor = comments["data"]["comments"][0]["reply_cursor"]
Confidence
89% confidence
Finding
requests.post(f"{BASE}/api/v1/reddit/post/comments", headers=HEADERS, json=

External Transmission

Medium
Category
Data Exfiltration
Content
json={"post_id": post_id, "sort": "TOP"}).json()

reply_cursor = comments["data"]["comments"][0]["reply_cursor"]
replies = requests.post(f"{BASE}/api/v1/reddit/post/comments/replies", headers=HEADERS,
    json={"post_id": post_id, "cursor": reply_cursor}).json()

# 4. Subreddit feed
Confidence
88% confidence
Finding
requests.post(f"{BASE}/api/v1/reddit/post/comments/replies", headers=HEADERS, json=

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:42