Reddit Search

Reddit Search — Search posts, comments, users, and subreddits across 100M+ indexed Reddit entries. Find discussions, track topics, discover communities, and analyze engagement. No Reddit API key needed — works through Xpoz MCP with natural language queries.

This skill appears to do what it says (calls Xpoz MCP via the mcporter CLI) but you should take a few precautions before installing: 1) Verify the mcporter npm package provenance (publisher, download counts, source repo) — npm packages run code on install and create binaries. 2) Inspect or vet the xpoz-setup skill (what OAuth scopes it requests, where tokens are stored) before authorizing; confirm you trust xpoz.ai and mcp.xpoz.ai. 3) Be aware that search results and CSV exports will be fetched from external URLs (S3 links) — do not auto-run or open downloaded files from unknown sources. 4) Because the registry summary omitted the SKILL.md's declared dependencies (xpoz-setup and network host), ask the publisher to correct metadata or provide source code/a homepage link for the mcporter package. If you cannot verify the npm package and the xpoz-setup flow, run the skill in a sandboxed environment or decline installation.

Type: OpenClaw Skill Name: reddit-api Version: 1.2.0 The skill is classified as suspicious due to its reliance on installing and executing a third-party `mcporter` binary via `npm` (as specified in `SKILL.md`). This introduces a significant supply chain vulnerability, as the `mcporter` package itself could contain malicious code, leading to arbitrary code execution (RCE) on the agent's system. While the stated purpose of the skill (Reddit search via xpoz.ai) appears benign, the black-box nature of the `mcporter` binary and its communication with `mcp.xpoz.ai` represent an untrusted dependency and a potential attack vector, even without explicit malicious instructions in the provided files.