ClawHub
Back to skill

Security audit

Reddit Search

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Reddit lookup CLI that fetches public Reddit data and does not request credentials, persistence, or local-file access.

Install only if you are comfortable with a small Node CLI making outbound requests to Reddit public JSON endpoints. Keep the npm dependencies patched, preferably pin axios to a reviewed fixed version, and avoid using it in environments where proxy-based dependency or HTTP-client vulnerabilities would carry high impact.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description partially matches the code: it does search Reddit for subreddits and get information about them. However, the implementation includes additional user-facing capabilities not reflected in the description, most notably fetching posts from a subreddit and listing popular/new subreddits. It also extracts subreddit links from descriptions as part of the info output. These are material undeclared capabilities beyond simple subreddit search/info, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.2 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
94% confidence
Finding

The lockfile pins axios 1.13.2, and the supplied advisories include high-risk issues such as SSRF-related NO_PROXY bypasses and prototype-pollution-based request/response compromise paths. Because this skill performs outbound Reddit searches, an HTTP client vulnerability is directly relevant: if attacker-controlled URLs, redirects, proxy settings, or polluted objects influence requests, the skill could be abused for unauthorized network access, credential leakage, or tampered responses.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High
Category
Supply Chain
Confidence
84% confidence
Finding

form-data 4.0.5 is flagged for CRLF injection through unescaped multipart field names/filenames. This is relevant if the skill ever builds multipart requests using untrusted input; crafted values could corrupt request boundaries or inject unintended headers/body content, which may enable request smuggling or downstream parsing issues.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.2 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill declares axios 1.13.2, which the finding states is associated with multiple known advisories, including SSRF-related and MITM/prototype-pollution-linked issues. Because this skill's purpose is to search Reddit and likely performs outbound HTTP requests, a vulnerable HTTP client is directly in the attack surface and could enable request manipulation, proxy bypass, credential leakage, or response tampering depending on runtime usage.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest description says the skill is for searching Reddit for subreddits and getting information about them. The code additionally implements getSubredditPosts and exposes it via the posts command, which retrieves post content from a subreddit rather than subreddit metadata or search results.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low
Category
Supply Chain
Confidence
87% confidence
Finding

follow-redirects 1.15.11 is flagged for leaking custom authentication headers across cross-domain redirects. In a search skill that makes outbound HTTP requests, this matters if the client sends API keys, bearer tokens, cookies, or other custom auth headers and then follows attacker-influenced redirects, potentially exposing secrets to an unintended host.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency is specified with a caret range (^1.13.2), which permits automatic installation of newer minor and patch releases rather than an exact vetted version. This weakens build reproducibility and can unexpectedly introduce malicious or vulnerable transitive behavior through supply-chain updates, though by itself it is a lower-severity hygiene issue.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json
"license": "ISC",
  "type": "commonjs",
  "dependencies": {
    "axios": "^1.13.2"
  }
}

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The built-in documentation presents the tool as able to query Reddit endpoints and specifically includes a posts command for getting top posts from a subreddit. This exceeds the manifest's stated scope of searching for subreddits and getting information about them.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.