reddit-browse-and-post
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides template commands using
curlto interact with Reddit's JSON API. These are routine for a social media integration skill. - [DATA_EXPOSURE]: The skill requires sensitive credentials (
REDDIT_CLIENT_SECRET,REDDIT_PASSWORD) but strictly instructs the agent to read these from the environment (.envfile) and never from the user chat or hardcoded strings. This is a standard and secure practice for credential management. - [EXTERNAL_DOWNLOADS]: The skill interacts with Reddit's official domains (
reddit.com,oauth.reddit.com). These are well-known services and do not escalate the security risk. - [REMOTE_CODE_EXECUTION]: The skill uses a simple Python one-liner to parse JSON output from a
curlresponse (python3 -c "import sys,json;print(json.load(sys.stdin)['access_token'])"). This is a safe and standard method for data extraction from API responses. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from Reddit (thread content, comments, and rules). While this presents an ingestion surface for untrusted content, the skill includes hard rules regarding user approval for any actions and focuses on structured JSON data, minimizing the risk of accidental instruction obedience.
Audit Metadata