ClawHub
Back to skill

Security audit

Reddit 主题洞察

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Reddit research and Chinese-content generation workflow, with normal network/API use and local output files but some prompt-injection and dependency hygiene risks.

Install only if you want a Chinese-oriented Reddit research workflow that will contact Reddit, optionally use Reddit API credentials from environment variables, and save collected Reddit data plus generated drafts under runs/<slug>/. Review generated content before publishing because Reddit posts or comments could influence the AI-produced drafts, and prefer installing dependencies in a pinned virtual environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
workflow/step-5-angles.md:19
Finding

Untrusted Reddit Content Is Inserted into AI Prompts Without Prompt-Injection Controls

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:148
Finding

Third-Party Dependency Is Installed Without Version or Integrity Pinning

Content
View full analysis
Remediation
View remediation
``` 2. Generate and verify package hashes, then install with: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Use a lock file that pins all transitive dependencies, not only the direct dependency. 4. Install dependencies inside a dedicated virtual environment rather than a shared or system Python environment. 5. Configure an approved package index explicitly and avoid untrusted mirrors. 6. Periodically review and update pinned versions after vulnerability and compatibility testing. 7. Run dependency auditing tools in continuous integration to identify known vulnerabilities. 8. Avoid running package installation commands with administrator or root privileges. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)

Tainted flow: 'auth' from os.getenv (line 65, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/python/reddit_collector.py (reported line 70)May include surrounding context.

python
headers = get_reddit_headers(config)

    try:
        resp = requests.post(
            "https://www.reddit.com/api/v1/access_token",
            auth=auth,
            data=data,

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

声明描述的是一个端到端的研究与内容生产工作流，而提供的代码仅是其中的 Reddit 采集子模块。代码行为集中在：读取关键词、向 Reddit 搜索接口发起请求、处理速率限制、可选 OAuth2 鉴权、去重、热度排序和保存 posts 数据。它没有执行主题需求收集、关键词自动设计、帖子详情抓取深化分析、爆款角度提炼，也没有生成任何面向 X、小红书或公众号的成品文案。因此，代码实际功能与整体技能声明存在明显范围差异和能力缺失，属于描述与行为不一致。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill advertises and orchestrates network access, local file reads/writes, and use of environment variables for Reddit API credentials, but it does not declare any explicit tool scope or allowed-tools boundary. This weakens least-privilege controls and makes it easier for an agent runtime to grant broader capabilities than the user expects, especially given the workflow persists collected data locally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The natural-language description is written entirely in Chinese and specifies output for Chinese platforms such as 小红书 and 公众号, implying a fixed locale and content context. There is no opt-in or stated option for other languages or locales, which may violate language-choice policy expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger conditions are broad enough to activate on ordinary Reddit-analysis requests, which can cause the agent to invoke a data-collecting, file-writing, networked workflow without sufficiently specific user intent. In context, this is more dangerous because the skill performs multi-step collection and local persistence, so over-triggering can lead to unexpected data handling or unnecessary API usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill omits clear user disclosure that it will collect Reddit content over the network, store intermediate and final outputs locally, and may consume API credentials from environment variables. Lack of transparency undermines informed consent and can expose users to unexpected data retention, credential use, and compliance/privacy issues.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file is written entirely in Chinese and presents the skill guidance in a single forced locale. The file does not offer an opt-in language choice or explain that the skill is intentionally region- or language-specific, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file defines the template entirely as a required Xiaohongshu note format in Chinese, including hard constraints like title length and style, but does not indicate that language choice is optional. This creates a natural-language policy concern because it effectively forces a specific language/locale without user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code file contains user-facing natural language in the module docstring and CLI help text entirely in Chinese, and it also generates Chinese report headings. Under the policy, forcing a specific language without offering a user-selectable locale or documenting a justified regional constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code file includes user-facing documentation and CLI help text in Chinese only, which forces a specific language on users. The policy allows locale constraints only when users can opt in or when the restriction is clearly justified, neither of which is present here.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/python/reddit_collector.py (reported line 70)May include surrounding context.

python
headers = get_reddit_headers(config)

    try:
        resp = requests.post(
            "https://www.reddit.com/api/v1/access_token",
            auth=auth,
            data=data,

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The workflow sets the default audience to '对该主题感兴趣的中文互联网用户', which bakes in a Chinese-language audience assumption without explicit user opt-in. This can cause unwanted localization, misaligned outputs, and exclusion of intended non-Chinese audiences, especially because downstream steps generate platform-specific finished content based on this stored default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

SQP-3 covers natural-language policy violations, including forcing a specific language without user opt-in. This file presents all operational instructions in Chinese and does not provide an alternative language option or note that the skill is intended only for Chinese-speaking users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

该技能文件整体以中文给出操作说明与子代理提示词，且未见任何允许用户选择语言/locale 的说明。按规则，若技能强制特定语言而无用户 opt-in 或合理的地域化说明，属于自然语言政策违规。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file consistently mandates Chinese-language output and Chinese-platform formats such as 小红书笔记 and 公众号文章, and all prompt/template text is written as fixed Chinese instructions. There is no user opt-in, configurable language selection, or stated regional/business justification for this locale constraint, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file presents all operational instructions in a single language and does not indicate that the user can opt into another language. The stated policy flags language or locale constraints when a skill effectively forces one language without user choice or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The entire template is written as a prescriptive规范 for公众号 articles in Chinese and does not indicate that language choice is optional. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This is a markdown file, so SQP-2 applies to missing user-facing warnings in the skill description. The document explains HTTP requests to Reddit and saving fetched content to posts_detail.json, but does not warn that the step will transmit requests to an external service and persist retrieved data locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file explicitly instructs the skill to generate content.md, which affects user data on disk. Under the markdown-file criteria for missing warnings, the description should disclose that the step writes or overwrites a local file so users understand the system impact.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.