reddit-post-finder
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Reddit posts and comments via the Apify API.
- Ingestion points: External content is fetched in
scripts/search_reddit.pyand returned to the agent context. - Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded commands within the retrieved Reddit content.
- Capability inventory: The provided scripts perform network GET/POST operations to fetch data.
- Sanitization: No sanitization or filtering is performed on the scraped titles or body text before presentation to the agent.
- [COMMAND_EXECUTION]: The documentation instructs the agent to execute a local Python script to perform searches.
- Evidence:
python3 skills/reddit-post-finder/scripts/search_reddit.pyinSKILL.md. - [EXTERNAL_DOWNLOADS]: The skill makes network requests to external services to retrieve scraping results.
- Evidence: Communicates with
api.apify.com(a well-known service) andapi.gooseworks.ai(a vendor-owned proxy) inscripts/search_reddit.py.
Audit Metadata