Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local social-media post analyzer whose behavior matches its stated purpose, with privacy cautions around the post text users choose to process or export.
Installers should treat this as a local analysis tool and only provide posts they are allowed to analyze. Be careful with private drafts, confidential campaigns, or third-party personal data, especially when using JSON output because it includes short text previews from the input posts.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
# Use Reddit user history API
curl "https://www.reddit.com/user/USERNAME/submitted.json?limit=100" | python3 -c "
import json, sys
data = json.load(sys.stdin)
posts = [{'text': p['data']['title'] + ' ' + p['data'].get('selftext', ''),
The skill explicitly instructs users to export and process social-media post text, engagement metrics, and platform data without any privacy warning, data-minimization guidance, or note about handling third-party/personal information. While the omission is not an exploit by itself, it can lead users to ingest sensitive or regulated data into local workflows or downstream tooling without understanding the privacy implications.
The tool includes user-supplied post content in its human-readable report, which can expose sensitive or proprietary text to anyone who views logs, terminal history, shared screenshots, or downstream report storage. In this context, the script is explicitly designed to process potentially private social media drafts and historical posts, so echoing content back without warning or redaction creates a real confidentiality risk even though it is not code execution.
The JSON output exports text previews derived from input posts, which makes accidental data disclosure more likely because JSON is commonly ingested into logs, pipelines, dashboards, and artifact storage. Since this skill is a data-processing CLI intended for batch analysis, the structured export increases the chance that sensitive text is propagated beyond the original operator without explicit consent or disclosure.