ClawHub
Back to skill

Security audit

Reddit 主题洞察

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Reddit research workflow that fetches public Reddit content and saves local draft outputs, with no evidence of hidden exfiltration, destructive behavior, or persistence beyond run files.

Install this only if you are comfortable with the agent making outbound requests to Reddit, optionally using Reddit API credentials from your environment, and storing Reddit-derived data plus generated drafts under runs/<slug>. Review generated content before publishing, and avoid using sensitive private topics unless local storage of the collected material is acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The trigger conditions are broad natural-language phrases such as general mentions of Reddit research or analysis, which can cause the skill to activate in contexts where the user did not intend data collection or content generation. Unintended activation matters here because the skill performs network access and local file writes across a multi-step pipeline.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill description says it will automatically collect Reddit discussions and produce outputs through a pipeline, but it does not warn users that this involves outbound network requests and writing multiple local files. Lack of disclosure increases the risk of surprising external access, unintended storage of scraped content, and mishandling of potentially sensitive user topics.

Missing User Warnings

Low
Confidence
83% confidence
Finding
The documentation instructs users to provide Reddit API credentials through environment variables but does not include guidance on secret handling, logging hygiene, or avoiding credential exposure in outputs and debug traces. While the text does not directly exfiltrate secrets, normalizing credential use without safeguards raises the chance of accidental leakage.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.