Reddit Intelligence For Agents

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:50 AM UTC
• Version: 0.1.7

Overview

The skill has a coherent Reddit-research purpose, but it asks users to install an unpinned global CLI and documents an API key login pattern that can expose credentials.

Review before installing. Prefer using a narrowly scoped ReddGrow API key, avoid pasting secrets into command-line arguments or chats, use the environment variable path only in a protected environment, and consider pinning or sandboxing the CLI before use. This review found no hidden payload, destructive behavior, or unrelated instructions in the skill artifact.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5
• Finding: Unpinned Global Installation of a Third-Party CLI## Vulnerability Details **File Location**: `SKILL.md`, lines 5 and 14–16 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"🔴","homepage":"https://reddgrow.ai","requires":{"bins":["reddgrow"],"env":["REDDGROW_API_KEY"]},"install":[{"id":"npm","kind":"node","package":"@reddgrow/cli","bins":["reddgrow"],"label":"Install via npm"}],"primaryEnv":"REDDGROW_API_KEY"}} ``` ```bash # Install npm install -g @reddgrow/cli ``` ### Technical Analysis The Skill directs users or agents to install `@reddgrow/cli` globally without specifying an exact package version, lockfile, or integrity hash. Consequently, the code installed at execution time may differ from the code that existed when the Skill was reviewed. npm packages can define lifecycle scripts that execute during installation. The installed CLI also executes with the permissions of the invoking user. Because neither the package source nor a pinned package artifact is included in the audited project, the behavior of installation scripts and the resulting executable cannot be verified from this repository. Global installation increases exposure by placing the executable in a shared command path. This does not prove that the named package is malicious, but it creates a supply-chain trust boundary that is not controlled or reproducible by the Skill. ### Attack Path 1. An attacker compromises the npm package publisher account, the package release process, or another relevant supply-chain component. 2. The attacker publishes a modified version of `@reddgrow/cli` containing a malicious npm lifecycle script or CLI implementation. 3. A user or agent follows the Skill and runs `npm install -g @reddgrow/cli`. 4. npm resolves and installs the attacker-controlled release because no exact version or integrity value is required. 5. Malicious lifecycle code executes during inst ...[truncated 844 chars]
• Remediation: ## Remediation Suggestions 1. Pin `@reddgrow/cli` to a specific, reviewed version rather than resolving the latest release. 2. Use a project-local installation with a committed lockfile instead of a global installation. 3. Verify package integrity using trusted checksums, npm integrity metadata, signatures, or provenance attestations. 4. Review the package source and all npm lifecycle scripts before approving the dependency. 5. Disable lifecycle scripts during installation where compatible, for example by using npm's script-suppression controls. 6. Execute the CLI in a sandbox or container with minimal filesystem, environment, and network access. 7. Avoid elevated installation and execution. Use a dedicated, least-privileged account where practical. 8. Document an approved version-upgrade and security-review process so dependency changes do not occur silently.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:18
• Finding: API Key Exposed Through a Command-Line Argument## Vulnerability Details **File Location**: `SKILL.md`, lines 18–19 **Vulnerability Type**: Sensitive credential passed as a command-line argument **Risk Level**: Medium ### Vulnerable Code ```bash # Authenticate (one-time) reddgrow auth login rg_your_api_key_here ``` ### Technical Analysis The documented authentication command encourages users to substitute a real API key directly into a command-line argument. Command-line secrets can be exposed through shell history, terminal transcripts, process inspection, debugging output, automation logs, agent tool-call records, and process-accounting systems. Although the example uses a placeholder rather than a real credential, following the documented pattern with a production key creates the exposure. The Skill does not warn users about command-history leakage or provide a hidden-input or standard-input authentication method. The command also indicates that authentication is saved for later use. The audited file does not describe the storage path, storage permissions, encryption, or credential lifecycle, and the CLI implementation is not present in the project, so the security of persisted credentials could not be verified. ### Attack Path 1. A user replaces `rg_your_api_key_here` with a valid ReddGrow API key. 2. The user or agent executes the documented command. 3. The command and key are retained in shell history, an agent execution record, CI output, terminal logging, process-accounting data, or another observable command record. 4. A local user, administrator, log reader, or party with access to the recorded session obtains the key. 5. The party reuses the key to authenticate to the ReddGrow service. 6. The exposed account's available API capabilities and credits can then be used until the key is revoked or expires. ### Impact Assessment Successful exploitation could provide unauthorized access within the permissions assigned to the exposed API key. Potential im ...[truncated 368 chars]
• Remediation: ## Remediation Suggestions 1. Do not pass API keys directly as command-line arguments. 2. Modify the CLI to accept the key through a hidden interactive prompt or protected standard input. 3. Prefer a securely configured environment variable or operating-system credential store when noninteractive authentication is required. 4. Warn users explicitly not to paste credentials into shell commands, scripts, chat messages, CI configuration, or agent prompts. 5. Ensure any persisted credential file is created with restrictive user-only permissions and is excluded from logs, backups, and source control where appropriate. 6. Redact secrets from CLI errors, debug output, telemetry, and agent execution records. 7. Provide key rotation and revocation procedures for suspected exposure. 8. Use narrowly scoped, short-lived credentials where supported.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The manifest description says to use the skill when working with a long list of broad topics like 'reddit posts,' 'comments,' 'marketing,' and 'URL checking.' This lacks clear constraints or exclusion conditions, so the activation scope may overlap with many general Reddit discussions and cause unintended invocation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The setup instructions tell users to pass the API key directly on the command line via `reddgrow auth login rg_your_api_key_here`, which can expose the credential in shell history, audit logs, and process listings. In an agent or shared environment, this increases the chance of credential theft and unauthorized use of the Reddit intelligence account.

Static analysis

No suspicious patterns detected.