Reddit 主题洞察

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears purpose-aligned: it gathers public Reddit discussions, stores local workflow files, and drafts content, with disclosed notes around scripts, optional Reddit API credentials, and local persistence.

Before installing, be comfortable with the skill making Reddit API requests, optionally using your Reddit API client credentials, requiring Python/requests setup, and writing workflow files under runs/<slug>. Review all generated copy before posting it to X, 小红书, or 公众号.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The skill will make network requests to Reddit and create or overwrite files in the selected runs/<slug> workflow directory.

Why it was flagged

The skill asks the agent/user to run local Python scripts that fetch Reddit data and write local output files. This is central to the stated purpose and is scoped to a run directory.

Skill content
Step 3: 数据采集 [Python 脚本] reddit_collector.py → posts_raw.json; Step 4: reddit_detail_fetcher.py → posts_detail.json; Step 7: content_merger.py → content.md
Recommendation

Use it only for intended Reddit research topics, keep outputs in the expected run directory, and review generated drafts before publishing them.

What this means

If you set these environment variables, the skill can use your Reddit API application credentials to get higher Reddit rate limits.

Why it was flagged

The collector optionally reads Reddit API client credentials from environment variables and sends them to Reddit's OAuth token endpoint. This is disclosed and purpose-aligned, with no evidence of logging or unrelated credential use.

Skill content
client_id = os.getenv("REDDIT_CLIENT_ID"); client_secret = os.getenv("REDDIT_CLIENT_SECRET"); requests.post("https://www.reddit.com/api/v1/access_token", auth=auth, ...)
Recommendation

Only provide Reddit credentials you intend to use for this research workflow, and avoid setting broader secrets in similarly named environment variables.

What this means

You have less external provenance to verify and may need to install dependencies manually before the scripts work.

Why it was flagged

The skill has limited provenance/setup metadata despite bundled scripts and a manually disclosed requests dependency in SKILL.md. The included code is readable and purpose-aligned, but setup is not fully declared in metadata.

Skill content
Source: unknown; Homepage: none; Install specifications: No install spec — this is an instruction-only skill.
Recommendation

Review the bundled scripts before use and install the requests package only from a trusted Python package source.

What this means

Generated content may reflect biases, errors, or manipulative text present in the Reddit discussions used as source material.

Why it was flagged

Fetched Reddit content is saved and reused as AI context for angle planning and content generation. This is expected for the skill, but public Reddit text can influence the generated drafts.

Skill content
主 Agent 从 `posts_detail.json` 构建精简摘要 ... 使用以下 Prompt 调用 SubAgent ... {posts_summary_json}
Recommendation

Treat Reddit-derived material as untrusted source context and review the final content and source table before reusing or publishing it.