reddit-insights

Pass

Audited by Gen Agent Trust Hub on Apr 4, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill configuration instructs the agent to run an MCP server using npx reddit-insights-mcp. This command downloads and executes a package from the NPM registry at runtime as a core part of the skill's functionality.
  • [EXTERNAL_DOWNLOADS]: The installation process for both Claude Desktop and OpenClaw environments involves fetching the reddit-insights-mcp package from the public NPM registry.
  • [COMMAND_EXECUTION]: The documentation provides shell commands for manual skill installation (mkdir, cp) and for listing/verifying MCP servers using mcporter.
  • [PROMPT_INJECTION]: The skill processes user-generated content from Reddit, which creates a surface for indirect prompt injection where malicious instructions embedded in posts could attempt to influence the agent's behavior.
  • Ingestion points: Untrusted data enters the context through the reddit_search and reddit_get_subreddit tools.
  • Boundary markers: No specific delimiters or instructions are provided to the agent to treat Reddit post content as data rather than instructions.
  • Capability inventory: The skill possesses the ability to search posts, list subreddits, and retrieve trending topics via the MCP server.
  • Sanitization: The skill description does not mention any sanitization or filtering of the retrieved Reddit content before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 4, 2026, 09:05 AM