reddit-api
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install well-known and reputable libraries from official package registries.
- Python dependencies include
praw,pydantic-settings,httpx, andfastapi. - Node.js dependency includes
snoowrap. - [PROMPT_INJECTION]: The skill enables the agent to ingest untrusted data from an external source (Reddit), creating a surface for indirect prompt injection attacks.
- Ingestion points: Untrusted content is fetched via functions like
subreddit.hot(),subreddit.stream.comments(), andsubmission.comments.fetchAll()in SKILL.md. - Boundary markers: The instructions do not provide delimiters or safety warnings to ensure the agent distinguishes between instructions and fetched Reddit content.
- Capability inventory: The skill provides broad capabilities including reading data, submitting posts/comments, and voting, which could be abused if an agent is manipulated by injected content.
- Sanitization: There is no evidence of sanitization or filtering of the fetched Reddit text before it is presented to the agent's context.
Audit Metadata