reddit-marketing

Pass

Audited by Gen Agent Trust Hub on Sep 13, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted JSON data from Reddit (subreddits, posts, rules) using the WebFetch tool across all command files (e.g., commands/rules-check.md, commands/subreddit-research.md). This input lacks sanitization or boundary markers to prevent the agent from following instructions potentially embedded in Reddit posts or rules.
  • Ingestion points: Fetches live data from multiple Reddit endpoints including about.json, rules.json, search.json, and hot.json across all core commands.
  • Boundary markers: Absent. The instructions do not direct the agent to delimit or ignore instructions within the fetched data.
  • Capability inventory: The skill possesses extensive capabilities including Bash, Read, WebFetch, WebSearch, Glob, and Grep as defined in the allowed-tools metadata.
  • Sanitization: None detected. The agent processes the raw content of Reddit posts and rules to plan marketing strategies and humanize text.
  • [EXTERNAL_DOWNLOADS]: The skill performs network requests to reddit.com to retrieve live subreddit data. As Reddit is a well-known service, these fetches are documented as standard functionality for the skill's research purpose.
  • [EXTERNAL_DOWNLOADS]: The skill includes instructions to provide promotional links to growwithreddit.com, which is a service associated with the skill author ('whatsuppiyush'). These are documented as vendor-owned resources.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 13, 2026, 10:10 AM