skills/sky-flux/skills/reddit/Gen Agent Trust Hub

reddit

Pass

Audited by Gen Agent Trust Hub on Apr 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local curl and jq commands to interact with the Reddit API and perform data transformations. These operations are restricted to standard analytical functions necessary for the tool's stated purpose.
  • [EXTERNAL_DOWNLOADS]: Fetches public discussion data from Reddit's official JSON API endpoints. This is a well-known service, and the skill performs these downloads using standard, transparent HTTP requests with appropriate rate-limit handling.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and analyzes untrusted text content from third-party Reddit posts and comments.
  • Ingestion points: Data enters the system via reddit.sh fetch, reddit.sh search, and reddit.sh comments calls to public Reddit endpoints.
  • Boundary markers: The skill currently lacks explicit boundary markers or "ignore embedded instructions" delimiters when presenting fetched Reddit content to the AI agent for analysis.
  • Capability inventory: The skill has capabilities for local file writing (reports and state management), network requests (fetching data), and executing analytical bash scripts. It does not possess direct eval or exec capabilities on the ingested data.
  • Sanitization: Content is parsed and enriched using jq before being analyzed, which ensures that ingested text is treated as data rather than shell commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 5, 2026, 02:34 PM