search-reddit
Warn
Audited by Snyk on Mar 1, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 1.00). The skill explicitly queries reddit.com via the OpenAI web_search tool and "enriches each thread by fetching Reddit JSON (/r/.../comments/.../.json)" (SKILL.md), so the agent ingests untrusted, user-generated Reddit content that can influence its outputs and actions.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The skill fetches live Reddit JSON at runtime (e.g. https://reddit.com/r/.../comments/.../.json) and injects those thread/comment contents into the model context to enrich prompts, so external Reddit-hosted content can directly influence agent prompts.
Audit Metadata