reddit-post-engine
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches external data from Reddit (subreddit rules, descriptions, and top post titles) to tailor post drafts. This data is untrusted and is incorporated into the prompt for the Gemini API, creating a surface for indirect prompt injection where malicious instructions embedded in Reddit content could influence the agent's behavior.
- Ingestion points: SKILL.md (Step 3) performs multiple fetches from reddit.com API endpoints to gather community context.
- Boundary markers: The prompt template for the drafting AI lacks explicit delimiters or instructions to ignore potential commands embedded in the fetched external data.
- Capability inventory: The agent can execute shell commands (curl, python3) and use the reddit-composio MCP tool to post to Reddit, which could be exploited if the agent's instructions are successfully overridden.
- Sanitization: While the skill truncates fetched strings to several hundred characters, it does not sanitize the content for malicious prompt injection payloads.
- [COMMAND_EXECUTION]: The skill uses python3 -c to parse and filter JSON data received from the Reddit API. This is a standard local processing pattern.
- [EXTERNAL_DOWNLOADS]: The skill connects to reddit.com and generativelanguage.googleapis.com to perform its core functions. Both are well-known and trusted services.
Audit Metadata