reddit-search

Pass

Audited by Gen Agent Trust Hub on Jun 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scripts/setup.sh file fetches a bash script from the author's official GitHub repository (FinpeakInc/frevana-cli-releases) to handle environment setup.
  • [REMOTE_CODE_EXECUTION]: The scripts/setup.sh script executes the downloaded initialization code using the shell. This is used for vendor-specified component initialization.
  • [COMMAND_EXECUTION]: The scripts/search_reddit.sh script executes several local system commands, including curl for health checks, python3 for payload generation and response parsing, and the frevana binary to interface with the local daemon.
  • [PROMPT_INJECTION]: The skill ingests untrusted data from Reddit search results.
  • Ingestion points: Search results are stored in SCRAPE_FILE within scripts/search_reddit.sh.
  • Boundary markers: The script does not wrap the final JSON output in explicit boundary markers or delimiters before providing it to the agent context.
  • Capability inventory: The skill allows file system writes (via the --output flag) and execution of the local frevana binary.
  • Sanitization: The skill uses a Python script to validate that the ingested content is well-formed JSON before it is returned to the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 15, 2026, 06:58 AM
Security Audit — agent-trust-hub — reddit-search