reddit-scraper
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Reddit (posts and comments) via the Apify actor
parseforge/reddit-posts-scraper. This content is processed and returned to the agent's context, creating a surface for attackers to embed instructions within Reddit discussions to manipulate the agent. - Ingestion points: The
scripts/search_reddit.pyscript retrieves data fromapi.apify.comwhich originates from Reddit's public feeds. - Boundary markers: There are no explicit boundary markers, delimiters, or instructions provided to the agent to treat the scraped content as untrusted data.
- Capability inventory: The skill performs network operations to the Apify API using the
requestslibrary and outputs the fetched data. - Sanitization: The script performs local filtering based on keywords and dates but does not provide any sanitization or filtering for potential prompt injection patterns in the text content.
Audit Metadata