reddit-campaign-launcher
Warn
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
@reddgrow/clipackage from the public npm registry. This package is from a third-party source and is installed globally without a specific version pinning or integrity verification. - [COMMAND_EXECUTION]: The skill uses various shell commands to interact with the
reddgrowCLI, performing operations like campaign creation, advocate management, and draft processing. - [DATA_EXFILTRATION]: The CLI tool communicates with the external domain
app.reddgrow.aito manage campaign data, advocate personas, and draft content. - [PROMPT_INJECTION]: The skill accepts unvalidated input for campaign talking points and advocate instructions which are used by the agent to generate Reddit drafts, creating a surface for indirect prompt injection. 1. Ingestion points:
references/commands.md(via--custom-instructionsand--talking-pointsflags). 2. Boundary markers: Absent. 3. Capability inventory: Shell command execution via thereddgrowCLI. 4. Sanitization: No sanitization or validation of the input strings is mentioned.
Audit Metadata