reddit-json-fetch
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches data from Reddit's official JSON endpoint to bypass restrictions on standard web fetching tools.
- [COMMAND_EXECUTION]: Instructs the agent to execute
curlwith specific headers and URL patterns to retrieve structured data. - [PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted content from Reddit, presenting a surface for indirect prompt injection attacks where adversarial text in posts or comments could attempt to manipulate the agent.
- Ingestion points: Reddit JSON content fetched from
www.reddit.comas described inSKILL.md. - Boundary markers: No delimiters or specific instructions are provided to the agent to treat the fetched content as data rather than instructions.
- Capability inventory: Employs
curlto retrieve external data. - Sanitization: No sanitization, validation, or filtering of the fetched JSON body is performed before processing.
Audit Metadata