reddit-scout
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
rdtx.mjsscript executes external binariesagent-browserandyt-dlp. It also performs dynamic code execution by evaluating JavaScript strings within the browser session via the Chrome DevTools Protocol (Runtime.evaluate). - [DATA_EXFILTRATION]: The skill extracts browser session cookies and saves them to a local file (
~/.rdtx/cookies.txt) via theexportCookiesNetscapefunction inrdtx.mjs. This is used to authenticateyt-dlpfor downloading Reddit media. - [PROMPT_INJECTION]: The skill processes untrusted external content from Reddit (post titles, bodies, and comments) in
rdtx.mjsandrdtx-contracts.mjs. Ingestion points:cmdRead,cmdArchive,cmdScout,cmdVoice,cmdInboxinrdtx.mjs. Boundary markers: None. Capability inventory: Writing capabilities viacmdSubmitandcmdCommentinrdtx.mjs. Sanitization: String slicing and basic normalization.
Audit Metadata