ClawHub
Back to skill

Security audit

Reddit (read only - no auth)

Security checks across malware telemetry and agentic risk

Overview

This is a coherent read-only Reddit browsing helper that sends user-directed Reddit queries to Reddit and does not show posting, credential use, persistence, or local data access.

Install this only if you are comfortable with a local Node script contacting reddit.com and sending the subreddit names, post URLs/IDs, and search terms you ask it to inspect. It does not require Reddit login credentials and the reviewed artifacts do not show account-changing actions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
80% confidence
Finding
This code sends user-provided search terms and subreddit scopes to Reddit over HTTP via public JSON endpoints. Although the file header says the script is 'read-only', it does not explicitly warn at the call sites or via user-facing output that supplied queries are transmitted to an external service.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/reddit-readonly.mjs:16