Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a data-oriented extension designed to facilitate research and social listening by fetching public Reddit records. All operations are explicitly described as read-only.
- [EXTERNAL_DOWNLOADS]: The README.md specifies installation via the UnifAPI Agents plugin marketplace (
unifapi-agent/agents) and theunifapi@unifapipackage. These resources are hosted on the vendor's own infrastructure and align with the provided author context. - [DATA_EXFILTRATION]: The skill uses the
unifapitool for secure connectivity via OAuth. It only accesses public data (subreddits, posts, comments, user activity) and does not handle sensitive user credentials or private files. - [PROMPT_INJECTION]: No patterns attempting to bypass safety filters or override agent behavior were found. The instructions are focused on defining deterministic workflows for data retrieval.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from Reddit, which is a common surface for indirect prompt injection.
- Ingestion points: Operations such as
reddit/posts/{id}/commentsandreddit/feed/*retrieve user-generated content from Reddit. - Boundary markers: No specific delimiters or "ignore instructions" warnings are included in the prompt templates.
- Capability inventory: The skill is restricted to network-based read operations through the UnifAPI service; it lacks capabilities for local file-system modification, subprocess execution, or arbitrary code execution.
- Sanitization: No explicit sanitization or filtering of the retrieved content is mentioned, which is expected for a raw data retrieval skill.
Audit Metadata