reddit-insights
Warn
Audited by Snyk on Mar 6, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). This skill's SKILL.md describes MCP tools (e.g., reddit_search, reddit_get_subreddit) that fetch and ingest public, user-generated Reddit posts via reddit-insights.com and instruct the agent to read and act on those posts (e.g., identify recurring complaints and product opportunities), which exposes the agent to untrusted third-party content that could contain indirect prompt injection.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The skill's setup runs "npx reddit-insights-mcp" (which fetches and executes the remote npm package at runtime) as a required MCP server dependency, so the npm-hosted package (reddit-insights-mcp) is a runtime-executed external dependency; the site https://reddit-insights.com is also referenced for API keys.
Audit Metadata