reddit-sf-community
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/run_engagement.pyutilizessubprocess.check_callto ensure thecomposiolibrary is installed at runtime. This is a standard dependency management practice used to ensure the execution environment has the necessary toolkits for the skill's primary function. - [EXTERNAL_DOWNLOADS]: The skill communicates with well-known and trusted services including Reddit, Slack, and Composio. It performs a runtime installation of the
composiopackage via pip and fetches tool schemas from Composio's official backend to facilitate API interactions. - [PROMPT_INJECTION]: The skill implements significant defensive measures against prompt injection and accidental compliance with malicious data. These include a non-negotiable 'draft-only' requirement and a dedicated validation script (
scripts/validate.py) that filters drafts for AI-generated patterns and strictly prohibits product mentions. - [DATA_EXFILTRATION]: While the skill includes network capabilities, these are scoped to its intended functionality—reading Reddit threads and sending operator notifications to Slack. Sensitive credentials, such as API keys and bot tokens, are managed correctly through environment variables rather than being hardcoded in the source files.
Audit Metadata