Reddit Skills

• Analyzed: Apr 7, 2026, 3:41 PM
• Findings: 1
• Version: 1.0.9
• Hash: d29f1bd0a0362245b9db5cc07c1d23d00a7b6e5af6caa13caff108ad6480784f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The reddit-skills bundle is a functional automation toolkit that uses a Python-to-Chrome-Extension bridge to operate Reddit via a user's active browser session. It utilizes high-privilege Chrome permissions, including 'debugger' and 'cookies', which are technically justified for handling complex web components (like file uploads via DOM.setFileInputFiles) and session management without the official Reddit API. While the extension includes a 'get_cookies' command and the Python scripts can trigger arbitrary JavaScript execution via the debugger, all network activity is strictly limited to localhost (ws://localhost:9334) and Reddit domains, with no evidence of data exfiltration or malicious intent. The SKILL.md instructions use standard prompt engineering to constrain the AI agent to the provided CLI, and the image downloader includes a local caching mechanism in the user's home directory.