Security audit

Keyapi Reddit

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate KeyAPI Reddit data helper, with the main user consideration being that it stores and uses a local KeyAPI token and sends requested lookups to KeyAPI.

Install only if you are comfortable using KeyAPI for Reddit lookups. Treat KEYAPI_TOKEN as a secret, prefer the interactive setup over passing --token on the command line, and review broad report requests because repeated or multi-page runs will make additional live API calls and may consume credits.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The file explicitly states that API calls are live by default and that repeating the same parameters triggers repeated external requests, but it provides no user-facing warning or consent step before network transmission. In a skill that handles user-provided Reddit targets and potentially account-contextual endpoints, this can cause unintended data disclosure to a third-party service, surprise network activity, and accidental repeated requests.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.secret_argv_exposure

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/keyapi-api.mjs:127

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: references/setup-and-auth.md:42