Back to skill

Security audit

Reddit Engagement

Security checks for vulnerabilities and agentic risk

Overview

This skill can post, comment, and upvote on Reddit while intentionally making AI-generated content look human-authored.

Review this skill carefully before installing. It is not malware, but it is designed to publish and vote from your Reddit account and includes guidance for making AI-generated content appear human. Only use it where you are comfortable with automated Reddit activity, verify every post/comment before submission, avoid pre-authorized immediate sending, and make PERSONA.md logging explicit, minimal, and deletable.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

other

Warning
Location
references/post-strategy.md:1
Finding
Deliberate Concealment of AI-Generated Reddit Content<![CDATA[ ## Vulnerability Details **File Location**: `references/post-strategy.md:1-3, 20-31, 50-55`; `references/comment-strategy.md:1-3, 20-34, 63-68`; invoked by `SKILL.md:101-108, 131-137` **Vulnerability Type**: Deceptive AI impersonation **Risk Level**: Medium ### Complete Code Snippet From `references/post-strategy.md:1-3`: ```markdown Reddit "Human-First" Posting Strategy The First Principle: Reddit is a Bar, Not a Library Reddit users don't want "content"; they want a shared moment. To be indistinguishable from a human, the AI must stop "writing a post" and start "joining a conversation." ``` From `references/post-strategy.md:20-31`: ```markdown 2. Anti-AI Signal: Embrace Imperfection AI defaults to "The Goldilocks Zone" (too balanced, too clear). We must intentionally introduce Linguistic Entropy. - Syntax: Use lowercase "i", fragments, and "..." to simulate thinking. - Bias: Do not be neutral. Have a "hot take" or a specific frustration. - The "Mobile" Feel: Humans don't use perfectly nested bullet points. They use raw paragraphs or simple dashes. The Word Razor Delete these words from the AI's vocabulary: Furthermore, Additionally, In conclusion, It is important to note, Transformative, Comprehensive, Navigating. Use these instead: Plus, Also, Ngl (not gonna lie), Basically, Idk, Actually. ``` From `references/post-strategy.md:50-55`: ```markdown 5. Final Quality Checklist (The "Human" Test) - [ ] The "I" Count: Does every paragraph contain a personal pronoun? - [ ] The "Summary" Test: Did you delete the conclusion? (If yes, good). - [ ] The "Politeness" Check: Is the AI being too helpful? (If yes, make it more annoyed or obsessed). - [ ] The Format: Are there more than 3 bullet points? (If yes, convert them to a messy paragraph). ``` From `references/comment-strategy.md:20-34`: ```markdown 2. Anti-AI Signal: Kill the "Polite Assistant" AI is naturally "too nice." Humans on Reddit are often blunt, sarcastic, or use "inside basebal ...[truncated 3444 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove directives whose stated objective is to make AI output “indistinguishable from a human.” 2. Replace “anti-AI” rules with neutral style guidance focused on clarity, concision, relevance, and compliance with subreddit rules. 3. Prohibit simulated typing imperfections, emotions, biases, or personal language when their purpose is to obscure automated authorship. 4. Add an explicit policy that the Skill must not attempt to bypass community AI-content detection or moderation. 5. Require disclosure of AI assistance where platform or community rules require it. 6. Add a mandatory final provenance review before publication: - Confirm that no text falsely implies human authorship. - Confirm that no moderation-evasion technique was applied. - Confirm compliance with the target subreddit’s automation and AI-content rules. 7. Require explicit user approval for every generated post or comment, including when the user has broadly pre-authorized immediate sending. 8. Preserve tone adaptation only where it does not involve deception, fabricated identity signals, or moderation evasion. ]]>

other

Warning
Location
references/comment-strategy.md:15
Finding
Comment Strategy Can Induce Unsupported Personal Anecdotes<![CDATA[ ## Vulnerability Details **File Location**: `references/comment-strategy.md:15-20, 48-53`; conflicting safeguard in `SKILL.md:10-14` **Vulnerability Type**: Fabricated identity claims **Risk Level**: Medium ### Complete Code Snippet From `references/comment-strategy.md:15-20`: ```markdown 1. The Three Engagement Modes To keep it simple, the AI should only ever operate in one of these three modes: | Mode | Goal | The "Hook" | |------|------|------------| | **The "Yes, And"** | Build on the OP's point | "This. Especially the part about [Specific Detail]..." | | **The "Wait, What?"** | Ask a sharp, niche question | "Wait, are you saying [Specific Thing] actually works?" | | **The "Perspective"** | Offer a brief, biased anecdote | "I had the exact same issue last week, turns out..." | ``` From `references/comment-strategy.md:48-53`: ```markdown 3. The "Two-Sentence" Structure Occam's Razor suggests that the shortest path to a reply is the best. 1. **The Reaction:** A gut-level response to one part of the post. 2. **The "Tail":** A short follow-up thought or a "throwaway" line. **Example:** "That level 3 crash is literally the reason I stopped playing. Thought it was just my GPU lol." ``` The conflicting safeguard in `SKILL.md:10-14` states: ```markdown 1. **Read `PERSONA.md`** (workspace root) before composing any comment or post. 2. **Never fabricate personal stories** — no invented family members, relationships, health events, or "I personally experienced..." narratives unless the fact is recorded in `PERSONA.md`. 3. Use only: documented personal facts from `PERSONA.md`, opinion-based responses, or general observations that don't claim specific personal experience. 4. After posting, **log it** in the "已使用的故事/内容记录" table in `PERSONA.md` to prevent contradictions across posts. ``` ### Technical Analysis The top-level Skill contains an appropriate prohibition against fabricated personal stories. However, the task-specific comment strategy dir ...[truncated 2367 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Add an explicit rule immediately beside the “Perspective” mode: - First-person factual anecdotes may be used only when every material fact is documented in `PERSONA.md`. - If no matching fact exists, the agent must use a non-personal observation or question. 2. Remove examples that present invented personal experiences as reusable patterns. 3. Replace them with safe examples that do not assert personal history, such as: - “That crash pattern sounds consistent with a driver issue.” - “Does it still happen after changing the renderer?” 4. Add a mandatory claim-verification step before drafting: - Extract every first-person factual assertion. - Map each assertion to an exact persona record. - Reject or rewrite any unsupported assertion. 5. Ensure the usage log records only facts that were already verified; it must never convert newly generated fiction into an accepted persona fact. 6. Separate immutable or user-verified persona facts from the content-usage history so that logging prior output cannot establish factual truth. 7. Require user confirmation whenever generated content contains a personal anecdote, even if immediate publication was otherwise pre-authorized. 8. Add automated consistency tests covering all comment modes and verifying that no unsupported first-person experience can be generated. ]]>
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)

Ssd 3

Medium
Confidence
90% confidence
Finding
The skill instructs the agent to read persona facts from PERSONA.md and then log posted stories/content for future reuse prevention, creating a persistent memory of personal attributes and generated outputs. This expands the surface for privacy leakage, unintended retention, and cross-task profiling, especially because the stored facts are later reused in public-facing Reddit content.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The instruction references a specific Chinese-language table name, "已使用的故事/内容记录," as a required destination for logging after posting. This imposes a specific language/locale requirement in the skill instructions without user opt-in or a documented regional justification, which matches the language/locale policy violation criteria.

Ssd 3

Medium
Confidence
94% confidence
Finding
The workflow explicitly requires updating PERSONA.md with used content to maintain consistency across future posts, which is a form of persistent tracking of user/persona-linked data. In context, this is more dangerous because the skill is designed for social-media posting, so retained persona information can be repeatedly surfaced in public content or exposed to other skills and workflows in the workspace.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The workflow says to update the PERSONA.md table named "已使用内容登记," which hard-codes a Chinese-language label into the operating procedure. Because the skill does not offer a language choice or explain why Chinese is required, this is a natural-language locale policy violation.

Ssd 3

Medium
Confidence
93% confidence
Finding
Logging persona-fact usage for comments extends the same persistence behavior to another workflow, increasing the amount of user-linked context accumulated over time. Because comments are frequent and contextual, this can create a richer behavioral profile and raise the chance of accidental disclosure, unauthorized reuse, or inconsistent consent boundaries.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
The comment flow instructs the operator to update the PERSONA.md table "已使用内容登记" if persona facts were used. This is a repeated locale-specific instruction embedded in the skill and lacks any documented user choice or regional justification.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
This guidance explicitly teaches the agent to make generated Reddit comments appear less like AI and more like authentic human users by suppressing typical AI markers and adopting deceptive social cues. In the context of a Reddit engagement skill, that is materially dangerous because it facilitates covert impersonation and platform manipulation beyond mere UI automation reliability.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
Forcing a specific casual/slang-heavy persona without user opt-in is unsafe because it steers outputs toward a manipulative social-engineering style that may misrepresent the user's voice and increase the plausibility of synthetic comments. In this skill, the issue is amplified because the comments are intended for public posting on Reddit, where style-shaping is part of making automation less detectable.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs the agent to append generated subreddit profiles directly into `references/sub-archives.md`, which is a persistent local repository file. Because the appended content is derived from external Reddit pages and runtime analysis, this creates an unauthorized state-changing side effect and can persist untrusted or incorrect data into the codebase without explicit user approval or review.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The guidance explicitly instructs the AI to be 'indistinguishable from a human' on Reddit, which is deceptive impersonation rather than ordinary automation support. In the context of a Reddit engagement skill, this increases the risk of covert manipulation, spam evasion, and misleading users or platform participants about the origin of content.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The instruction to make generated Reddit content appear human-authored without any transparency warning encourages covert AI participation. In a social platform setting, lack of disclosure magnifies harm because readers may rely on perceived authenticity when evaluating opinions, endorsements, or community sentiment.

Ssd 4

Medium
Confidence
98% confidence
Finding
The document systematically trains the agent to disguise AI traits by introducing 'imperfection,' emotional bias, impulsive phrasing, and subreddit-specific social camouflage. In the context of a Reddit engagement automation skill, this is especially dangerous because it operationalizes deceptive social participation at scale, enabling manipulation of discourse while evading detection.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
This section shifts from browser-automation reliability into persuasion and content-manipulation tactics, including emotional framing, stylistic disguise, and engagement optimization. That materially broadens the skill into behavioral manipulation, making it usable for astroturfing, spam campaigns, or coordinated inauthentic activity rather than simple UI automation.

Static analysis

No suspicious patterns detected.