subreddit-research
Warn
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install an external Node.js package,
@reddgrow/cli, from the NPM registry to interact with Reddit. - [COMMAND_EXECUTION]: Multiple shell commands are utilized to invoke the
reddgrowCLI for searching subreddits, fetching metadata, and managing community lists. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from live Reddit feeds (posts, comments, and wiki pages) and processes it to perform analysis and provide recommendations.
- Ingestion points: Data enters the context via
reddgrow reddit subreddits posts,reddgrow reddit subreddits comments, andreddgrow reddit subreddits wikicommands inreferences/commands.md. - Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the external content as untrusted data.
- Capability inventory: The agent can execute various CLI commands, including modifying campaign data through the
reddgrow subreddits quick-addcommand. - Sanitization: No evidence of sanitization or filtering of the external data before it is presented to the agent for analysis was identified.
Audit Metadata