reddit-ads
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits a potential surface for indirect prompt injection within its 'Agentic Optimization Service'.
- Ingestion points: Performance data, which includes campaign and ad identifiers, is retrieved from the Reddit Ads API via the
getReport(Node.js) andget_report(Python) methods inSKILL.md. - Boundary markers: The performance data JSON is interpolated directly into the system prompt for the optimization agent without delimiters or instructions to ignore embedded commands.
- Capability inventory: The skill has the capability to programmatically modify advertising campaigns through
updateAdandupdateAdGroup(Node.js) orupdate_adandupdate_ad_group(Python) calls inSKILL.md. - Sanitization: There is no evidence of sanitization or validation of the strings returned by the Reddit API (e.g., ad names or headlines) before they are incorporated into the prompt context.
Audit Metadata