reddit-commenter

SUSPICIOUS. The skill is broadly aligned with Reddit automation, and its only named dependency (Playwright MCP) appears to be an official same-org tool, so there is no strong malware or credential-harvesting signal. However, it gives an agent the ability to read untrusted Reddit content and external links, then autonomously post public comments and update lead files, creating meaningful indirect prompt-injection and autonomy risk that is disproportionate for a simple commenting helper.