reddapi

Use this skill to access Reddit's full data archive via reddapi.dev API. Features semantic search, subreddit discovery, and real-time trend analysis. Perfect for market research, competitive analysis, and niche opportunity discovery.

What to consider before installing and using this skill: - Metadata mismatch: The documentation clearly requires REDDAPI_API_KEY for Authorization, but the skill metadata does not declare any required environment variables or primary credential. Ask the publisher or maintainer to update the metadata to explicitly declare REDDAPI_API_KEY (and specify expected scopes/permissions). - Unknown source/homepage: The skill has no source repository or homepage. Prefer skills that provide a source repo or homepage so you can inspect code, check who maintains it, and verify claims. - Least privilege for API keys: If you decide to use it, create a dedicated reddapi.dev API key with minimal permissions and rotate/delete it after testing. Do not reuse high-privilege keys (e.g., keys tied to billing or other services). - Verify the API domain: Confirm reddapi.dev is the intended service, check its TLS certificate and official docs, and review its privacy/retention policy (what it does with queried data and any PII). - Test in a sandbox: Because the skill is instruction-only, it’s low install risk, but you should still test calls from an isolated environment (or with a throwaway key) to observe behavior and responses. - Ask for more transparency: Request a homepage or source code and an explicit metadata update (declaring REDDAPI_API_KEY as a required credential). If the publisher cannot provide those, consider it higher risk and avoid supplying real secrets. Confidence notes: The main reason for a "suspicious" verdict is the clear mismatch between SKILL.md examples (which require an API key) and the registry metadata (which declares none), combined with the lack of a verifiable source or homepage. If the publisher provides a source repo or updates metadata to declare the required credential, this assessment could move to benign (assuming no other issues are found).

Type: OpenClaw Skill Name: reddapi Version: 2.0.0 The skill bundle is benign. All network requests are directed to the documented `https://reddapi.dev` API, using an environment variable (`$REDDAPI_API_KEY`) for authentication, which is standard practice. The `SKILL.md` file contains `curl` examples and a `python3 -c` command for processing API output, but the Python script's logic is simple JSON parsing and printing, showing no malicious intent or attempts at data exfiltration, persistence, or prompt injection against the agent. No obfuscation or suspicious external dependencies were found.