Reddit User Acquisition

What to check before installing or running this skill: 1) Ask the author for source code and an installation README. The SKILL.md references Python scripts (reddit_search.py, reddit_post.py, approval_bot.py, etc.) and config/data files, but none of these executables are included — you should not run an installer or grant credentials until you can inspect the code that will run with them. 2) Clarify missing credentials: the spec requires a Telegram approval bot and Slack integration but does not declare TELEGRAM_* or SLACK_* env vars. Ask whether those integrations are optional, and if not, request the full list of required environment variables and verify how those tokens are used and stored. 3) Audit the npm package: the install spec installs '@playwright/mcp' to provide playwright-cli. Verify this package name and review its npm page and source repository before installing. Prefer official Playwright packages (or documented release artifacts) from trusted sources. 4) Least-privilege credentials: if you provide Reddit access, create a dedicated Reddit app with minimal scopes and use a separate account dedicated to outreach; do not use your personal account or credentials that grant broad access to other services. Avoid giving password reuse; rotate credentials and use short-lived tokens where possible. 5) Confirm human-approval flow: SKILL.md emphasizes 'never send any message without explicit human approval.' Get a clear description of how approvals are delivered (Telegram bot? e-mail?), where approval state is stored, and whether any automation could bypass that gate. 6) Ask about persistence and data storage: the skill plans to write contacted_users, banned_list, logs, and other data. Ask where those files are stored, whether they will be encrypted, and whether they can be inspected/cleared. 7) Legal/terms check: targeted outreach and DMs may run afoul of platform rules or privacy expectations. Ensure you understand Reddit's API and community rules, and that you accept the risks of account moderation or bans. If the author cannot provide source code, a trustworthy npm package name, and a clear list of all required environment variables with justified usage, treat the skill as high risk and do not install or supply credentials.