Reddit Archive

Download and archive Reddit posts including images, GIFs, and videos from specified users or subreddits with filtering and sorting options.

This skill appears to do what it says: fetch public Reddit JSON and download images/videos. Before installing or running it consider: (1) the script may attempt to pip-install 'requests' and 'yt-dlp' on first run—if you prefer control, preinstall these in a virtualenv or container; (2) media downloads come from third‑party hosts (imgur, redgifs, gfycat, reddit media), so downloaded content is untrusted—run in an isolated folder and verify files before opening; (3) yt-dlp is invoked via subprocess to fetch videos—if you want to be extra cautious, provide a vetted yt-dlp binary via YTDLP_PATH; (4) review the full script yourself if possible (the provided file is straightforward but truncated output here); and (5) be mindful of copyright/privacy concerns when archiving other users' content. If you want maximum safety, run the script inside a disposable VM/container or review/modify the code to meet your environment policies.

Type: OpenClaw Skill Name: reddit-archive Version: 1.3.0 The skill is classified as suspicious due to two primary vulnerabilities that could lead to remote code execution (RCE) or arbitrary file writes if exploited via prompt injection against the agent. Firstly, the `scripts/reddit_archive.py` script allows the `yt-dlp` executable path to be overridden by the `YTDLP_PATH` environment variable, which is then executed via `subprocess.run`. A malicious agent prompt could set this variable to an arbitrary executable, leading to RCE. Secondly, the `--output` argument allows specifying any output directory, which could be exploited to write files to sensitive locations. While the stated purpose is benign, these capabilities present significant security risks without clear malicious intent within the skill's own code.