Devvit Publishing Auditor

Audits Reddit Devvit apps for environment, config, compliance, and documentation to ensure readiness before server upload.

Security Scan

The skill's instructions and required actions are coherent with an auditor for Devvit/Reddit publishing: it runs local devvit/ts checks and scans project files and explicitly asks for permission before making changes.

Purpose & Capability

Name and runtime instructions align: the skill is a pre-publish auditor that runs devvit CLI checks, type-checks, and scans project files for compliance. Nothing requested (no env vars, no external services) appears unrelated to that purpose.

Instruction Scope

SKILL.md and instructions.txt limit activity to local project checks (devvit CLI commands, tsc, scanning devvit.json, /src, /assets, and CSS). The instructions explicitly require user permission before running commands or broad directory scans, and they do not instruct exfiltration or contacting unexpected external endpoints.

Install Mechanism

This is an instruction-only skill with no install spec and no code files — nothing is written to disk by the skill itself. The only commands suggested use npx or user-run npm installs, which is appropriate for this use case.

Credentials

The skill requests no environment variables, credentials, or config paths. The checks it proposes (devvit whoami/version, scanning devvit.json and source) are proportional to auditing a Devvit app.

Persistence & Privilege

The skill does not request permanent presence or elevated agent privileges (always is false). It does not instruct modifying other skills or system-wide config; global installs are explicitly marked as requiring user confirmation.

Assessment

This skill appears to be what it says: a local pre-publish auditor that runs npx devvit commands, tsc, and scans files in your project. Before granting permission, consider: (1) the agent will run local commands (npx/tsc) which execute code from your environment — ensure you trust the Devvit CLI on your machine; (2) the auditor will read project files (devvit.json, /src, /assets, CSS) — do not allow scans if these folders contain secrets you don't want inspected; (3) the skill suggests advising a global npm update but explicitly warns not to run global installs without your consent — prefer performing installations yourself; (4) the skill metadata lacks a homepage or publisher description (source unknown), so if you require provenance, verify the author or use an audited, official Devvit tool instead.

A specialized auditor for Reddit Devvit developers to verify app readiness before uploading to the Reddit servers. It ensures compliance with Devvit CLI v0.12.x and Reddit’s publishing standards.

Overview

This skill acts as a pre-flight checklist runner. It performs environment checks, dependency validation, configuration audits, and compliance scans for Web View games.

How to use

1. Drop this folder/skill into your project.
2. Ask your coding agent: "Run the Devvit Publishing Auditor."
3. Follow the Go/No-Go report instructions.

Included Checks

• CLI/Env: Version checks, Auth status, and Type integrity.
• Config: devvit.json validation and permission mapping.
• Game Compliance: Asset size limits, scroll-trap detection, and launch screen verification.
• Docs: README and Privacy Policy requirements.