Reddit Lead Prospecting

Find buying-intent leads on Reddit via Brave Search — no Reddit account or OAuth needed. Score posts and generate value-first comments.

Security Scan

The skill's code, manifest, and runtime instructions are consistent with its stated purpose (finding Reddit posts via Brave Search and generating comment content) and the single required secret (BRAVE_API_KEY) appears proportionate.

Purpose & Capability

The name/description claim to search Reddit via Brave Search and generate comments/scores. package.json and SKILL.md both declare only BRAVE_API_KEY. No unrelated cloud credentials, binaries, or config paths are requested — this matches the stated purpose.

Instruction Scope

SKILL.md instructs using the included Node script to search, score, and generate comments. It explicitly says it does not use Reddit OAuth or the reddit.com API. The provided JS implements analysis, comment generation, scoring, and post templates. The code imports https (expected for calling the Brave Search API). Recommend verifying the (truncated) portions of reddit-prospecting.js that perform network calls to ensure they only contact Brave Search endpoints and do not attempt to post to Reddit or exfiltrate data.

Install Mechanism

No install spec is provided (no downloads or package installs). The skill ships as a small Node script and package.json. No external installers or archive downloads are present, which is low-risk.

Credentials

Only BRAVE_API_KEY is required (declared in SKILL.md and package.json). That is proportionate for a skill that queries Brave Search. I saw no other environment variables in the visible code. Confirm the remainder of the source does not read other env vars before trusting it.

Persistence & Privilege

The skill does not request always:true or other elevated persistence. It does not declare any config path writes or system-wide changes. Autonomous invocation is allowed (platform default) but there's no evidence the skill tries to persist credentials or modify other skills.

Assessment

This skill appears to do what it says: search Reddit via Brave Search and generate scoring/comment drafts. Before installing, review the full reddit-prospecting.js network code to confirm it only calls Brave Search endpoints (api.search.brave.com) and does not include hidden endpoints or code to post directly to reddit.com (posting would require Reddit auth). Keep your BRAVE_API_KEY private; a leaked API key could be abused to make queries on your quota. Also verify there are no unexpected environment variables or outbound hosts in the truncated part of the file. If you plan to actually post comments or DM users, be aware this package only generates content — posting requires a Reddit account and OAuth which this skill explicitly does not perform.

Reddit Lead Prospecting Skill

Find high-intent leads on Reddit using Brave Search (site:reddit.com) — no Reddit account, no OAuth, no credentials except a free Brave API key.

How It Works

Instead of Reddit's OAuth API (which requires app registration and credentials), this skill queries site:reddit.com via the Brave Search API. You get real Reddit posts and comments with buying intent — without touching Reddit's API at all.

Commands

Run with Node.js: node {baseDir}/reddit-prospecting.js <command> [args]

• search <keyword> — Find high-intent Reddit posts via Brave Search
• score — Score a Reddit prospect for lead quality
• comment — Generate a value-first comment structure for a post

Usage

node {baseDir}/reddit-prospecting.js search "looking for AI agent tool"
node {baseDir}/reddit-prospecting.js search "alternative to Zapier" --subreddit startups
node {baseDir}/reddit-prospecting.js score --username u/founder123 --post "frustrated with my current tool"
node {baseDir}/reddit-prospecting.js comment --title "Best AI tools for lead gen?" --subreddit AIMarketing

Environment Variables

• BRAVE_API_KEY — Brave Search API key. Free tier: 2,000 queries/month. Sign up at api.search.brave.com

What It Does NOT Use

• No Reddit client ID or secret
• No Reddit username or password
• No Reddit OAuth flow
• No direct calls to reddit.com API endpoints