Trust Assessment
reddit-search received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Unpinned npm dependency version, URL Path Injection via unsanitized subreddit name.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | URL Path Injection via unsanitized subreddit name The skill constructs API request URLs by directly interpolating user-provided subreddit names into the path without proper sanitization or encoding. Specifically, the `cmdInfo` and `cmdPosts` functions take a subreddit name from command-line arguments (`process.argv`). This name is then passed to `getSubredditAbout` or `getSubredditPosts`, which directly embeds it into the URL path (e.g., `/r/${name}/about.json` or `/r/${name}/${sort}.json`). An attacker could provide a subreddit name containing path traversal sequences (e.g., `../`) or other special characters to manipulate the API endpoint being called, potentially leading to unintended information disclosure, access to different Reddit API endpoints, or unexpected behavior. Although Reddit's API might reject malformed paths, the direct interpolation of untrusted input into a URL path segment is a vulnerability. Implement strict validation for the `name` parameter to ensure it only contains characters valid for a subreddit name (alphanumeric, underscores, hyphens). Alternatively, apply `encodeURIComponent` to the `name` parameter before interpolating it into the URL path. This issue also applies to line 60: `const payload = await requestJson(`/r/${name}/${sort}.json?limit=${limit}`);` | LLM | scripts/reddit-search.ts:34 | |
| MEDIUM | Unpinned npm dependency version Dependency 'axios' is not pinned to an exact version ('^1.13.2'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/thesethrose/reddit-search/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/5577b0c0034597e2)
Powered by SkillShield