reddit-research

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly tells the agent to ask users to paste API keys/codes and shows examples that embed those values verbatim into code/commands (e.g., XpozClient("THE_KEY_FROM_USER") and mcporter config with Authorization=Bearer {token}), which requires the LLM to handle and output secrets directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In Step 2 (“Via MCP”/SDK) the workflow fetches Reddit post fields including title and text using getRedditPostsByKeywords / client.reddit.search_posts, so outsider-authored Reddit content is ingested for analysis.