reddit-search
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/setup.shfile fetches a bash script from the author's official GitHub repository (FinpeakInc/frevana-cli-releases) to handle environment setup. - [REMOTE_CODE_EXECUTION]: The
scripts/setup.shscript executes the downloaded initialization code using the shell. This is used for vendor-specified component initialization. - [COMMAND_EXECUTION]: The
scripts/search_reddit.shscript executes several local system commands, includingcurlfor health checks,python3for payload generation and response parsing, and thefrevanabinary to interface with the local daemon. - [PROMPT_INJECTION]: The skill ingests untrusted data from Reddit search results.
- Ingestion points: Search results are stored in
SCRAPE_FILEwithinscripts/search_reddit.sh. - Boundary markers: The script does not wrap the final JSON output in explicit boundary markers or delimiters before providing it to the agent context.
- Capability inventory: The skill allows file system writes (via the
--outputflag) and execution of the localfrevanabinary. - Sanitization: The skill uses a Python script to validate that the ingested content is well-formed JSON before it is returned to the agent.
Audit Metadata