Reddit User Acquisition

• Analyzed: May 11, 2026, 4:35 AM
• Findings: 1
• Version: 1.0.0
• Hash: 30960f6e622a598afb01a4288db2023dd6d8ef6806140f6509d74e581b5b45f6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed for legitimate Reddit outreach, with strong ethical guardrails and human approval for all messages. However, the core functionality involves the AI agent processing untrusted external content from Reddit posts and comments (detailed in SKILL.md and processing-logic-v3.1.md, Phase 3: Draft). This interaction with untrusted input creates a significant prompt injection vulnerability against the AI agent itself, where a malicious Reddit post could potentially manipulate the agent's internal reasoning or influence its drafted messages, even with human oversight. The skill also requires sensitive Reddit API credentials and uses powerful tools like `playwright-cli` for browser automation, which, while necessary for its stated purpose, amplify the potential impact of such a vulnerability.