Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and executes the '@useclawlink/cli' package from the NPM registry using 'npx'. This is a legitimate vendor resource provided by 'clawlink-hq' for the skill's primary functionality.
- [COMMAND_EXECUTION]: Performs shell commands via the CLI to interact with the Reddit API. The instructions include a manual safety check requiring the agent to confirm all write operations with the user before execution.
- [PROMPT_INJECTION]: The skill ingests untrusted data from Reddit posts and comments (e.g., via 'reddit_get'), which constitutes an indirect prompt injection surface. This is mitigated by instructions to the agent to confirm actions with the user before any state-changing operations. Capability inventory includes 'reddit_create_reddit_post', 'reddit_edit_reddit_comment_or_post', and 'reddit_delete_reddit_post'.
- [SAFE]: Authentication credentials are stored locally in '~/.clawlink/credentials.json' using standard CLI authentication patterns. No credential exfiltration or unauthorized access patterns were identified.
Audit Metadata