reddit-scout

Pass

Audited by Gen Agent Trust Hub on Aug 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The rdtx.mjs script executes external binaries agent-browser and yt-dlp. It also performs dynamic code execution by evaluating JavaScript strings within the browser session via the Chrome DevTools Protocol (Runtime.evaluate).
  • [DATA_EXFILTRATION]: The skill extracts browser session cookies and saves them to a local file (~/.rdtx/cookies.txt) via the exportCookiesNetscape function in rdtx.mjs. This is used to authenticate yt-dlp for downloading Reddit media.
  • [PROMPT_INJECTION]: The skill processes untrusted external content from Reddit (post titles, bodies, and comments) in rdtx.mjs and rdtx-contracts.mjs. Ingestion points: cmdRead, cmdArchive, cmdScout, cmdVoice, cmdInbox in rdtx.mjs. Boundary markers: None. Capability inventory: Writing capabilities via cmdSubmit and cmdComment in rdtx.mjs. Sanitization: String slicing and basic normalization.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 7, 2026, 09:18 PM
Security Audit — agent-trust-hub — reddit-scout