reddit-sf-community

Pass

Audited by Gen Agent Trust Hub on Jun 17, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/run_engagement.py utilizes subprocess.check_call to ensure the composio library is installed at runtime. This is a standard dependency management practice used to ensure the execution environment has the necessary toolkits for the skill's primary function.
  • [EXTERNAL_DOWNLOADS]: The skill communicates with well-known and trusted services including Reddit, Slack, and Composio. It performs a runtime installation of the composio package via pip and fetches tool schemas from Composio's official backend to facilitate API interactions.
  • [PROMPT_INJECTION]: The skill implements significant defensive measures against prompt injection and accidental compliance with malicious data. These include a non-negotiable 'draft-only' requirement and a dedicated validation script (scripts/validate.py) that filters drafts for AI-generated patterns and strictly prohibits product mentions.
  • [DATA_EXFILTRATION]: While the skill includes network capabilities, these are scoped to its intended functionality—reading Reddit threads and sending operator notifications to Slack. Sensitive credentials, such as API keys and bot tokens, are managed correctly through environment variables rather than being hardcoded in the source files.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 17, 2026, 02:28 AM
Security Audit — agent-trust-hub — reddit-sf-community