reddit-post

Pass

Audited by Gen Agent Trust Hub on Jul 31, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses node:child_process.execFile to invoke external CLI tools, specifically agent-browser for CDP-based browser interaction and yt-dlp for downloading media content from Reddit.
  • [DATA_EXFILTRATION]: The skill accesses sensitive session data, such as Reddit cookies, but only to export them to a local file (~/.rdtx/cookies.txt) for use by yt-dlp. No evidence of data being sent to unauthorized external servers was found; all network operations are directed at official Reddit API endpoints.
  • [SAFE]: The skill implements significant safety controls: all write operations (submitting posts or comments) require an explicit --yes flag, performing a dry-run by default. Additionally, it maintains a local audit trail in ~/.rdtx/audit.jsonl to ensure transparency of the agent's actions.
  • [SAFE]: The skill uses JSON.stringify to sanitize and wrap user-provided content before executing it within the browser context via eval, preventing potential code injection from post titles or bodies into the automation script.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 31, 2026, 01:33 PM
Security Audit — agent-trust-hub — reddit-post