subreddit-pre-post-check
Warn
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install a global Node.js package
@reddgrow/clivianpm install -g. This is an external dependency from a non-standard source. - [COMMAND_EXECUTION]: The skill relies on the execution of multiple shell commands using the installed
reddgrowCLI tool to fetch subreddit data. - [PROMPT_INJECTION]: The skill processes third-party content from Reddit (rules and wiki pages) which acts as an indirect prompt injection surface.
- Ingestion points: Subreddit rules (
reddgrow reddit subreddits rules) and wiki pages (reddgrow reddit subreddits wiki-page) are ingested into the agent context inreferences/commands.md. - Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are defined for the content fetched from Reddit in
SKILL.md. - Capability inventory: The agent uses an authenticated CLI tool (
reddgrow auth login) capable of making network requests and performing Reddit operations. - Sanitization: There is no evidence of content sanitization or validation for the data retrieved from external Reddit sources.
Audit Metadata