Reddit Publisher
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's code, declared requirements, and runtime instructions align with its stated purpose of researching and publishing Reddit posts via ScrapeCreators (read) and Late (write).
This skill is coherent with its stated purpose, but review these before installing: 1) It will make network requests to https://api.scrapecreators.com and https://getlate.dev using the API keys you provide — only supply keys you trust. 2) Keys can be passed via environment variables or stored in ~/.config/* files as shown; protect those files (SKILL.md even recommends chmod 600). 3) The included Python scripts are small and readable; you can open them to verify behavior (they only perform HTTP calls to the two service APIs). 4) Because the skill can post via the Late API, ensure the connected Late account and Reddit permissions are acceptable. 5) If you need higher assurance, run the scripts in a constrained environment or review network traffic to confirm endpoints. Overall the skill appears internally consistent and not asking for unrelated privileges or secrets.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.