Reddit Research

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:42 AM UTC
• Version: 1.0.0

Overview

The skill has a plausible Reddit research purpose, but it asks for broad command and file access and advises administrator execution without enough scoping.

Review this carefully before installing. Use it only in a sandboxed, least-privileged workspace, do not run it as administrator, avoid exposing unrelated local files or credentials, and require explicit approval before any command execution or file access outside the intended research inputs and outputs.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:22

Finding

Excessive Tool Permissions and Unsafe Privilege-Elevation Guidance

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:22-26, SKILL.md:224-226, and SKILL.md:239
Vulnerability Type: Excessive command-execution and file-access privileges
Risk Level: Medium

Evidence

SKILL.md:22-26 declares broad file-discovery, file-reading, and command-execution tools:

yaml

tools:
- read
- exec
- glob
- grep

SKILL.md:224-226 describes generic file, API, and command-execution capabilities:

markdown

- **File processing**: Supports reading, parsing, and writing multiple file formats
- **API integration**: Calls external services through standardized interfaces and processes responses
- **Command execution**: Executes system commands in a secure sandbox and collects results

SKILL.md:239 recommends elevating privileges when file access fails:

markdown

| Insufficient permissions | Current user lacks read/write permission | Check file permissions and run as administrator |

Technical Analysis

The Skill's stated purpose is to extract and summarize Reddit trends, recurring issues, and content gaps. That task does not inherently require unrestricted local file discovery, generic system-command execution, or administrator-level privileges.

The declared glob, read, grep, and exec tools permit a supporting agent to discover and inspect local files and invoke operating-system commands. The documentation does not define enforceable path restrictions, command allowlists, argument validation, network endpoint restrictions, or a concrete sandbox policy. Merely claiming that commands run in a secure sandbox does not establish a security boundary.

The recommendation to run as administrator when permissions are insufficient is particularly unsafe. Permission errors ordinarily indicate that the requested resource falls outside the process's intended access boundary. Elevating privileges rather than correcting the scope can turn an otherwise limited u ...[truncated 1729 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec unless a specific, documented command is indispensable to the Reddit research workflow.
2. Replace generic shell execution with a dedicated Reddit API client exposing only the required operations.
3. Restrict file access to an explicit project-owned directory and reject absolute paths, traversal sequences, symbolic-link escapes, and access outside that boundary.
4. Define an enforceable allowlist for any retained commands, executable paths, arguments, and network destinations.
5. Never interpolate user input or retrieved Reddit content into shell command strings. Use structured APIs or fixed argument arrays with strict validation.
6. Remove the recommendation to run as administrator. Permission failures should terminate safely and direct users to correct the configured workspace scope.
7. Run the Skill under a dedicated unprivileged account with minimal filesystem and network permissions.
8. Treat Reddit posts and all other retrieved content as untrusted data, not executable instructions.
9. Add approval prompts for operations that access files outside the designated research workspace or invoke external processes.
10. Document and test the claimed sandbox boundary, including filesystem isolation, process restrictions, environment-variable protection, timeouts, and network egress controls.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says to use the skill whenever SEO optimization, keyword analysis, ranking improvement, or search traffic optimization is needed, which is a very broad set of common work contexts rather than a specific activation trigger. It does not provide explicit trigger phrases, scope boundaries, or negative examples beyond excluding black-hat SEO, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises exec capability and claims only whitelisted commands are allowed, but the file provides no actual whitelist, guardrails, or implementation details that would constrain execution. In an agent ecosystem, this can mislead operators into trusting a skill that may execute arbitrary commands if downstream tooling or prompts pass attacker-controlled input into exec.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The quick-start section instructs users to invoke the skill in an AI Agent conversation, but it does not define the exact trigger syntax, required context, or conditions distinguishing valid from invalid use. For a markdown skill description, this leaves activation ambiguous and can cause accidental or inconsistent invocation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.