reddit-marketing
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted JSON data from Reddit (subreddits, posts, rules) using the
WebFetchtool across all command files (e.g.,commands/rules-check.md,commands/subreddit-research.md). This input lacks sanitization or boundary markers to prevent the agent from following instructions potentially embedded in Reddit posts or rules. - Ingestion points: Fetches live data from multiple Reddit endpoints including
about.json,rules.json,search.json, andhot.jsonacross all core commands. - Boundary markers: Absent. The instructions do not direct the agent to delimit or ignore instructions within the fetched data.
- Capability inventory: The skill possesses extensive capabilities including
Bash,Read,WebFetch,WebSearch,Glob, andGrepas defined in theallowed-toolsmetadata. - Sanitization: None detected. The agent processes the raw content of Reddit posts and rules to plan marketing strategies and humanize text.
- [EXTERNAL_DOWNLOADS]: The skill performs network requests to
reddit.comto retrieve live subreddit data. As Reddit is a well-known service, these fetches are documented as standard functionality for the skill's research purpose. - [EXTERNAL_DOWNLOADS]: The skill includes instructions to provide promotional links to
growwithreddit.com, which is a service associated with the skill author ('whatsuppiyush'). These are documented as vendor-owned resources.
Audit Metadata