Reddit Skills

• Risk level: Low
• Analyzed: Apr 7, 2026, 3:14 PM
• Findings: 0
• Version: 1.0.9

Overview

The package appears internally consistent with its stated purpose (automation via a local browser extension + local WebSocket bridge) but installing an unpacked extension that can read cookies and use the debugger permission is sensitive — inspect the extension code and run in a controlled browser profile before using.

The skill's architecture is coherent: it automates Reddit by controlling your logged-in Chrome session through a local extension and a local WebSocket bridge. Before installing, do the following: 1) Manually inspect extension/manifest.json and extension/background.js to verify there are no remote endpoints or telemetry beyond ws://localhost:9334; 2) Understand that the extension uses your browser cookies and the 'debugger' permission — only enable it in a browser profile you control (consider a dedicated Chrome profile) and enable Developer Mode intentionally; 3) Verify you are comfortable with the tool auto-launching Chrome and caching downloaded images to ~/.reddit-skills/images; 4) Do not load the extension if you do not trust the repository owner; 5) Prefer running the code in a sandboxed environment or ephemeral profile, and review the bridge_server.py and background.js communication if you need higher assurance. If you want, provide the full extension/background.js and manifest.json contents for a focused review of the extension behavior (I could check for hidden endpoints or unexpected data exfiltration).