reddit-market-research
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches data from
arctic-shift.photon-reddit.com, which is a well-known community successor to the Pushshift Reddit archive used widely for research and data science. - [COMMAND_EXECUTION]: The skill executes a bundled Python script (
scripts/arctic.py) to perform API queries and data ranking. The script uses only Python's standard library (e.g.,urllib,json), avoiding external package dependencies and associated supply chain risks. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from Reddit comments. However, the instructions in
SKILL.mdandreferences/output-template.mdmitigate this by requiring the agent to perform evidence-bound extraction of specific market insights rather than executing instructions found within the data. - Ingestion points: Processed Reddit comment bundles in
_bundles/*.json(loaded inSKILL.md). - Boundary markers: The agent is directed to use specific structured markdown templates defined in
references/output-template.mdfor all outputs. - Capability inventory: The skill allows reading fetched bundles and writing research reports to the local file system.
- Sanitization: The
arctic.pyscript performs aggressive truncation and filtering of raw Reddit data before the agent processes it, reducing the likelihood of successful injection payloads.
Audit Metadata