Reddit Explore

This skill should be used when the user asks to "search Reddit", "explore Reddit posts", "find Reddit discussions about", "summarize Reddit opinions on", "what does Reddit think about", or wants to gather and summarize community opinions from Reddit on a specific topic.

This skill appears to do what it says: it runs a small Python script that uses your Apify API token to call the trudax/reddit-scraper-lite actor and returns Reddit posts for summarization. Before installing: 1) Verify provenance — the package has no homepage and an unknown source; if you don't trust the publisher, inspect the included files (scripts/reddit_search.py and references) yourself. 2) Understand the credential you provide: APIFY_TOKEN grants access to your Apify account and may incur costs; use a token with limited permissions if possible and monitor billing. 3) Confirm you are comfortable installing the apify-client Python package via pip. 4) Be aware scraped Reddit content is public but may contain personal data — consider privacy needs before aggregating or sharing results. 5) Because disable-model-invocation is true, the model won't call this skill autonomously; if you later enable autonomous use, reassess permissions and provenance. If you want higher assurance, request the publisher's homepage or a signed/reviewed release, or review the apify actor (trudax/reddit-scraper-lite) on Apify to confirm expected behavior.

Type: OpenClaw Skill Name: reddit-explore Version: 0.0.3 The skill is classified as suspicious due to a critical shell injection vulnerability identified in `SKILL.md`. The instruction `python3 ~/.agents/skills/reddit-explore/scripts/reddit_search.py --query "$ARGUMENTS" --max-items 30` directly embeds the `$ARGUMENTS` variable into a shell command without proper sanitization or quoting. This allows an attacker to inject arbitrary shell commands by crafting a malicious input for `$ARGUMENTS`, potentially leading to remote code execution on the agent's host system. The Python script `scripts/reddit_search.py` itself appears benign and performs its stated function of searching Reddit via Apify.