reddit-insights
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The installation instructions direct the user to run the MCP server using
npx reddit-insights-mcp. This command fetches and executes the latest version of the package from the NPM registry. - [COMMAND_EXECUTION]: The README.md and SKILL.md files contain shell commands for manual installation (
mkdir,cp) and configuration verification (mcporter list). These are standard administrative tasks for skill deployment. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted content from Reddit via the
reddit_searchandreddit_get_subreddittools. This creates an attack surface where malicious instructions embedded in Reddit posts could influence the agent. - Ingestion points: Untrusted data enters the agent context through the
reddit_searchandreddit_get_subreddittool outputs (SKILL.md). - Boundary markers: No explicit boundary markers or "ignore instructions" warnings are defined for the fetched Reddit content.
- Capability inventory: The skill provides search and retrieval tools; it does not expose dangerous capabilities like file system writes or arbitrary shell execution to the agent.
- Sanitization: There is no evidence of sanitization or filtering applied to the retrieved Reddit data before processing.
Audit Metadata