ClawHub
Back to skill

Security audit

Reddit Search

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Reddit lookup CLI that fetches public Reddit data and does not request credentials, persistence, or local-file access.

Install only if you are comfortable with a small Node CLI making outbound requests to Reddit public JSON endpoints. Keep the npm dependencies patched, preferably pin axios to a reviewed fixed version, and avoid using it in environments where proxy-based dependency or HTTP-client vulnerabilities would carry high impact.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The declared description partially matches the code: it does search Reddit for subreddits and get information about them. However, the implementation includes additional user-facing capabilities not reflected in the description, most notably fetching posts from a subreddit and listing popular/new subreddits. It also extracts subreddit links from descriptions as part of the info output. These are material undeclared capabilities beyond simple subreddit search/info, so this is a description-behavior mismatch.

Known Vulnerable Dependency: axios==1.13.2 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
94% confidence
Finding
The lockfile pins axios 1.13.2, and the supplied advisories include high-risk issues such as SSRF-related NO_PROXY bypasses and prototype-pollution-based request/response compromise paths. Because this skill performs outbound Reddit searches, an HTTP client vulnerability is directly relevant: if attacker-controlled URLs, redirects, proxy settings, or polluted objects influence requests, the skill could be abused for unauthorized network access, credential leakage, or tampered responses.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High
Category
Supply Chain
Confidence
84% confidence
Finding
form-data 4.0.5 is flagged for CRLF injection through unescaped multipart field names/filenames. This is relevant if the skill ever builds multipart requests using untrusted input; crafted values could corrupt request boundaries or inject unintended headers/body content, which may enable request smuggling or downstream parsing issues.

Known Vulnerable Dependency: axios==1.13.2 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
98% confidence
Finding
The skill declares axios 1.13.2, which the finding states is associated with multiple known advisories, including SSRF-related and MITM/prototype-pollution-linked issues. Because this skill's purpose is to search Reddit and likely performs outbound HTTP requests, a vulnerable HTTP client is directly in the attack surface and could enable request manipulation, proxy bypass, credential leakage, or response tampering depending on runtime usage.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The manifest description says the skill is for searching Reddit for subreddits and getting information about them. The code additionally implements `getSubredditPosts` and exposes it via the `posts` command, which retrieves post content from a subreddit rather than subreddit metadata or search results.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low
Category
Supply Chain
Confidence
87% confidence
Finding
follow-redirects 1.15.11 is flagged for leaking custom authentication headers across cross-domain redirects. In a search skill that makes outbound HTTP requests, this matters if the client sends API keys, bearer tokens, cookies, or other custom auth headers and then follows attacker-influenced redirects, potentially exposing secrets to an unintended host.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"license": "ISC",
  "type": "commonjs",
  "dependencies": {
    "axios": "^1.13.2"
  }
}
Confidence
95% confidence
Finding
The dependency is specified with a caret range (^1.13.2), which permits automatic installation of newer minor and patch releases rather than an exact vetted version. This weakens build reproducibility and can unexpectedly introduce malicious or vulnerable transitive behavior through supply-chain updates, though by itself it is a lower-severity hygiene issue.

Description-Behavior Mismatch

Low
Confidence
92% confidence
Finding
The built-in documentation presents the tool as able to query Reddit endpoints and specifically includes a `posts` command for getting top posts from a subreddit. This exceeds the manifest's stated scope of searching for subreddits and getting information about them.

Static analysis

No suspicious patterns detected.