reddit-cultivate

SUSPICIOUS. The skill is internally coherent as Reddit automation, but its actual footprint is high-risk: it tells the agent to enable a sensitive Chrome automation setting, execute JavaScript inside a logged-in browser, and autonomously post public comments using the user's authenticated session while explicitly aiming to evade bot detection. There is no third-party installer or off-domain credential exfiltration, so this is not confirmed malware, but the public-action capability and browser-session abuse make the skill unsafe.