apewisdom

SAFE max severity MEDIUMSkillSpector Caution 7 registry clawhub.ai last scanned 2 scans

Verdict safe, but 2 findings (1 medium, 1 low), mainly data exfiltration, resource abuse. Most recent scan 2026-02-05.

The apewisdom skill is a relatively straightforward Reddit sentiment scanner that fetches data from a third-party API. The primary security concern is the unvalidated trust placed in external API responses, which could be exploited if the API is compromised or returns malicious data. The skill does not attempt prompt injection, credential theft, or data exfiltration to attacker-controlled servers. However, it lacks important security metadata and proper error handling for network operations. The skill's behavior matches its stated purpose, and there are no hidden capabilities or deceptive elements. Overall risk level is MODERATE due to external API dependency without validation.

Scanner's overall assessment (LLM analyzer)
Findings2
Critical0
High0
Medium1
Low1
Analyzersstatic behavioral llm trigger meta

Second scanner: NVIDIA SkillSpector

VerdictCaution 7
Score7 / 100
Issues1
CategoriesMCP Least Privilege
Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Scan Reddit for trending stocks and sentiment spikes using the ApeWisdom API (free). Use this to find "meme stocks", retail momentum, and sentiment shifts on r/wallstreetbets.

Package
2 files, 3.7 KB
SKILL.md
142 words, 9 sections
Code
Python (1)

SKILL.md covers: ApeWisdom Reddit Scanner · Usage · Basic Scan (Top Mentions) · Find Spikes (Momentum) · Specific Subreddits · WallStreetBets only · SPACs · Crypto · Output Fields

Findings

MEDIUM Unvalidated External API Data Exfiltration Risk Data Exfiltrationllm

The skill makes network requests to an external third-party API (apewisdom.io) without any validation of the response data or error handling for malicious payloads. While the API appears legitimate, the skill blindly trusts and processes external data that could contain malicious content or be compromised. The response data is directly parsed and displayed without sanitization, creating a potential vector for indirect prompt injection or data manipulation.

scripts/scan_reddit.py

response = requests.get(url)
response.raise_for_status()
data = response.json()
return data.get("results", [])[:limit]
Remediation: 1. Implement response validation to verify data structure and types before processing. 2. Add content sanitization for all string fields from the API. 3. Implement rate limiting and request timeouts. 4. Consider caching responses to reduce external dependencies. 5. Add integrity checks or use HTTPS certificate pinning for the API endpoint.
LOW Missing Request Timeout Configuration Resource Abusellm

The network requests to the external API do not specify timeout parameters, which could lead to indefinite hanging if the API becomes unresponsive. This creates a potential availability issue where the agent could become blocked waiting for a response that never arrives.

scripts/scan_reddit.py:13

response = requests.get(url)
# No timeout parameter specified
Remediation: Add timeout parameters to all network requests: ```python response = requests.get(url, timeout=10) ``` This ensures requests fail gracefully rather than hanging indefinitely.

What is in the package

FileKindSize
SKILL.mddoc1.3 KB
scripts/scan_reddit.pyscript2.4 KB

External hosts referenced

apewisdom.io

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Scan history

DateVerdictFindingsChangeAnalyzersRaw
SAFE 2 -2 static behavioral llm trigger meta JSON
HIGH 4 first scan static behavioral llm trigger meta JSON

Sources

Related skills