reddit

SAFE max severity LOWSkillSpector Safe 14 registry clawhub.ai last scanned 1 scan

Verdict safe, but 1 finding (1 low), mainly resource abuse. Most recent scan 2026-02-07.

The Reddit skill is a READ-ONLY web scraping tool that uses Reddit's public JSON API to fetch posts and search content. Security analysis reveals NO CRITICAL or HIGH severity threats. The skill does not attempt prompt injection, data exfiltration, credential theft, or malicious code execution. It makes legitimate HTTP requests to Reddit's public API with appropriate User-Agent headers. The code is straightforward with no obfuscation, eval/exec usage, or command injection vulnerabilities. Three LOW severity findings were identified: (1) missing optional metadata fields in the manifest, (2) lack of rate limiting implementation that could lead to API throttling, and (3) references to non-existent files in the documentation. The skill operates as described - it provides read-only access to Reddit content without authentication, posting, or commenting capabilities. The implementation is transparent and matches its stated purpose.

Scanner's overall assessment (LLM analyzer)
Findings1
Critical0
High0
Medium0
Low1
Analyzersstatic llm meta

Second scanner: NVIDIA SkillSpector

VerdictSafe 14
Score14 / 100
Issues2
CategoriesMCP Least Privilege Output Handling
Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Read and search Reddit posts via web scraping of old.reddit.com. Use when Clawdbot needs to browse Reddit content - read posts from subreddits, search for topics, monitor specific communities. Read-only access with no posting or comments.

Package
3 files, 12 KB
SKILL.md
350 words, 12+ sections
Code
Python (1)

SKILL.md covers: Reddit Skill 📰 · Quick Start · Read top posts from a subreddit · Search for posts · Read newest posts · Options · Examples · Read subreddit posts · Top posts of the day (default) · Hot posts · New posts · Top posts of the week

Findings

LOW Missing Rate Limiting Implementation Resource Abusellm

The script makes HTTP requests to Reddit's JSON API without implementing rate limiting or retry delays. While the TECHNICAL.md documentation mentions Reddit's rate limits (~60 requests per minute), the code does not enforce delays between requests. This could lead to 403 Forbidden errors or temporary blocks from Reddit if users make rapid successive requests.

The script uses requests.Session() but does not implement:
- Request throttling/delays
- Exponential backoff on errors
- Rate limit tracking

Documentation acknowledges: 'Reddit's JSON API has rate limits: ~60 requests per minute (unauthenticated)'
Remediation: Add rate limiting to prevent API abuse: ```python import time class RedditScraper: def __init__(self): self.last_request_time = 0 self.min_request_interval = 1.0 # 1 second between requests def _fetch_json(self, url, params): # Enforce minimum delay between requests elapsed = time.time() - self.last_request_time if elapsed < self.min_request_interval: time.sleep(self.min_request_interval - elapsed) response = self.session.get(url, params=params) self.last_request_time = time.time() return response ```

What is in the package

FileKindSize
SKILL.mddoc2.9 KB
references/TECHNICAL.mddoc1.6 KB
scripts/reddit_scraper.pyscript7.2 KB

External hosts referenced

www.reddit.com github.com redd.it

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills