← Back to Skills Marketplace
Reddit Skill
by
Artem Vysotsky
· GitHub ↗
· v0.1.0
449
Downloads
0
Stars
1
Active Installs
1
Versions
Install in OpenClaw
/install reddit-skill
Description
Use ThreadPilot to manage Reddit account workflows (login, whoami, comments, replies, posts, subreddits, subscribe, read, search, rules, like, and post) with...
Usage Guidance
This skill appears to implement legitimate Reddit CLI workflows, but there are notable inconsistencies you should address before installing: 1) The registry declares no required credentials but the README/SKILL.md reference many sensitive env vars (e.g., REDDIT_ACCESS_TOKEN, browser profile paths) — only supply tokens or profiles if you trust the upstream code and are prepared for local access. 2) The skill will auto-download or clone/build the threadpilot binary from GitHub at runtime; review the target repos (vood/threadpilot and vood/reddit-skill) and their release artifacts before allowing network installs. 3) Because the package is instruction-only and does not bundle the scripts it references, confirm which scripts will run and where they come from. 4) Prefer running this in an isolated environment or test account, avoid reusing real Reddit credentials until you audit the upstream code, and consider setting THREADPILOT_RELEASE_BASE_URL to a vetted mirror or performing a manual install after inspection. The absence of regex scanner findings is not a guarantee of safety — it only means there was no code for the scanner to analyze.
Capability Analysis
Type: OpenClaw Skill
Name: reddit-skill
Version: 0.1.0
The skill is classified as suspicious primarily due to its auto-installation and execution of an external binary (`threadpilot`) from `https://github.com/vood/threadpilot/releases`, as described in `SKILL.md`, `README.md`, and `bin/REFERENCE.md`. This introduces a significant supply chain risk and potential Remote Code Execution (RCE) vulnerability, as the integrity and behavior of the external binary cannot be guaranteed. While the skill's instructions consistently emphasize human-in-the-loop safety and confirmation, the underlying `threadpilot` binary is not part of this bundle and its full behavior cannot be assessed. Additionally, the `REDDIT_CONFIRM_DOUBLE_POST` environment variable allows overriding duplicate-post protection, which could be exploited.
Capability Assessment
Purpose & Capability
The name/description (Reddit workflows via ThreadPilot) matches the runtime instructions (whoami, login, read, like, post). However, the registry lists no required environment variables or primary credential while the README/SKILL.md enumerate many sensitive env vars (REDDIT_ACCESS_TOKEN, REDDIT_BROWSER_PROFILE, etc.) — a mismatch between declared requirements and actual usage.
Instruction Scope
SKILL.md instructs running scripts/threadpilot commands and explicitly references environment variables and browser profile paths. It also directs auto-bootstrap from github.com/vood/threadpilot (download release or clone/build). The skill may therefore read local files (browser profiles, cache dirs) and run downloaded binaries/source code — actions beyond mere 'read-only' browsing and proportionally broader than the declared manifest.
Install Mechanism
There is no install spec in the registry, but the README and SKILL.md describe auto-installing threadpilot from GitHub releases or cloning and building source. Downloading and executing a release asset or building cloned code at runtime is higher risk than an instruction-only skill; although GitHub releases are a reasonable source, auto-bootstrap means arbitrary remote code may be fetched and executed without an install policy in the registry.
Credentials
The registry declares no required env vars, yet the documentation lists numerous variables including sensitive ones (REDDIT_ACCESS_TOKEN, REDDIT_BROWSER_PROFILE, THREADPILOT_BIN, REDDIT_PROXY). The mismatch means the agent could ask for or use secrets that were not signaled up-front; requiring browser profile paths or access tokens is plausible for this purpose but should be explicitly declared and justified.
Persistence & Privilege
always:false and no heavy privileges requested. The skill's bootstrap/cache behavior will create a .threadpilot cache and may write binaries locally if installing — expected for CLI tools, but it does alter local disk state. It does not request system-wide always-on presence or modification of other skills.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install reddit-skill - After installation, invoke the skill by name or use
/reddit-skill - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.0
Version 0.1.0
- Initial release of reddit-skill using ThreadPilot for browser-first Reddit account management from the CLI.
- Supports login, session verification, posting, comments, replies, subreddit rules checking, upvoting, subscribing, reading, and searching.
- Enforces human-in-the-loop safety with explicit confirmation or preview before engagement actions (likes, posts).
- Includes duplicate comment protection and recommends always retrieving subreddit rules before posting.
- Designed for command-line workflows with clear user prompts before publishing or interacting.
Metadata
Frequently Asked Questions
What is Reddit Skill?
Use ThreadPilot to manage Reddit account workflows (login, whoami, comments, replies, posts, subreddits, subscribe, read, search, rules, like, and post) with... It is an AI Agent Skill for Claude Code / OpenClaw, with 449 downloads so far.
How do I install Reddit Skill?
Run "/install reddit-skill" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Reddit Skill free?
Yes, Reddit Skill is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Reddit Skill support?
Reddit Skill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Reddit Skill?
It is built and maintained by Artem Vysotsky (@vood); the current version is v0.1.0.
More Skills