Security audit

Reddit Research Tool Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Reddit research helper that fetches public Reddit JSON and summarizes findings, with command/network access that is purpose-aligned but worth using carefully.

Install only if you are comfortable with the agent fetching public Reddit pages and possibly using curl/WebFetch. Keep use scoped to reddit.com URLs, avoid authenticated or NSFW content unless you explicitly intend it, and review any generated command before it runs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill grants broad exec capability and explicitly suggests curl/WebFetch for external retrieval even though the task is a narrow Reddit research workflow. If an attacker can influence inputs, this opens the door to arbitrary command execution patterns, unsafe shell composition, SSRF-like requests, or unintended access to local/system resources.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill instructs command execution and external fetching via exec/curl/WebFetch but does not present a clear up-front warning that using the skill may perform network access and local command execution. This can undermine user consent and safe operation, especially in agent environments where invocation may be automatic and external content is untrusted.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.