reddit-ads
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the
@useclawlink/clipackage vianpx. This is a standard mechanism for running vendor-provided tools and matches the author's verified namespace. - [COMMAND_EXECUTION]: The skill executes CLI commands to interact with the Reddit Ads API. These commands are limited to the functionality of the integration and include instructions for the agent to seek user confirmation before performing any write operations.
- [INDIRECT_PROMPT_INJECTION]: As an integration skill that reads external data (reports, campaigns, account history), the skill has an inherent surface for indirect prompt injection. However, this is expected for its primary purpose, and the skill includes specific instructions to confirm actions with the user, mitigating the risk.
- Ingestion points: Reddit Ads campaign data, report content, and account history retrieved via CLI.
- Boundary markers: The instructions explicitly state to 'confirm with the user before any write'.
- Capability inventory: The skill can create campaigns, ad groups, and creatives using shell commands.
- Sanitization: No explicit sanitization logic is detailed in the skill instructions.
Audit Metadata