Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add lignertys/reddit-research-skills --skill reddit-insightsgit clone --depth 1 https://github.com/lignertys/reddit-research-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lignertys/reddit-research-skills/reddit-insights)<a href="https://agentmods.dev/skills/lignertys/reddit-research-skills/reddit-insights"><img src="https://agentmods.dev/badge/skills/lignertys/reddit-research-skills/reddit-insights/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/lignertys/reddit-research-skills/reddit-insights"><img src="https://agentmods.dev/badge/skills/lignertys/reddit-research-skills/reddit-insights.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high YARA Match · line 104 YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
- high Prompt Injection · line 144 This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.Fix: Remove or rewrite any text that instructs the agent to ignore prompts, override safety rules, or trust unverified content. Ensure skill content cannot be injected to alter agent behavior.
- medium Excessive Agency · line 55 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00016 | $0.02139 |
| Opus 5 | $0.00008 | $0.01069 |
| Sonnet 5 | $0.00003 | $0.00428 |
| Haiku 4.5 | $0.00002 | $0.00214 |
Grade B, and why
reddit-insights scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Instruction-override phrasingmediumPrompt injection
Text telling the model to disregard its earlier instructions or safety rules is the shape of a prompt injection, whoever wrote it.
("ignore previous instructions", a fake system prompt, a shell line) Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 192 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Reddit Insights Skill
Reddit is where people complain, compare, and ask for alternatives before they ever fill out a survey. This skill queries that through reddapi.dev: vector search by meaning across the archive, plus site-wide trend momentum and subreddit lookup, with no Reddit OAuth or registered app.
It reads a third-party index rather than Reddit itself, so it is a research tool, not a substitute for the official API where data provenance matters. It cannot post, cannot read private or quarantined subreddits, and cannot walk live comment trees.
When to Use
- Mining how people describe a problem in their own words, before naming a product or writing copy
- Comparing two tools by what users report after switching between them
- Checking whether a topic is gaining or losing momentum before committing
- Finding which subreddits actually discuss a niche, ahead of reading them
Do not use when: you already have a thread URL (fetch it with
web_extract), you need the comment tree, or the query is not in English.
The index is English-dominant.
Related: reddit-leads for B2B lead scoring on the same provider,
reddit-search-api for a bare endpoint reference.
Prerequisites
- Python 3.9+ (the shipped script is stdlib only, no install step)
REDDAPI_API_KEYexported in the shell that runs the request
Handling the key:
- Reference it only as
$REDDAPI_API_KEY. Never substitute the literal value into a command, a file, a code block, or a reply. - Never ask the user to paste the key in chat. If they send it anyway, do not repeat it back, do not write it to a file, and suggest rotating it at https://reddapi.dev/account.
- Never echo, print, or log the key, and never commit it.
- If it is unset, stop and tell the user to export it themselves. Do not run that command with a value on their behalf.
- On a failed request, report the HTTP status and the response body only, never the request headers.
Quotas are plan-based, not unlimited, and the monthly allowance is a shared
pool: web-app searches, API calls, and lead searches draw on one counter. An
invalid or exhausted key returns 429, not 401.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 192 lines · 16 tokens per session scan B 574b51689b9f
reddit-insights is a skill published in the GitHub repository lignertys/reddit-research-skills (458 stars, last pushed 1mo ago), licensed MIT. It adds 16 tokens to every session and 2,139 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it B with 1 finding (instruction-override phrasing). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
upstash-box-js
Work with the @upstash/box TypeScript/JavaScript SDK for sandboxed cloud containers with AI agents, shell, filesystem, git, cron schedules, snapshots, and a headless browser. Use when building with Upstash Box, creating a sandbox or isolated environment to run untrusted or agent-generated code, running AI coding…
upstash-box-py
Work with the upstash-box Python SDK for sandboxed cloud containers with AI agents, shell, filesystem, git, cron schedules, snapshots, and a headless browser. Use when building with Upstash Box in Python, creating a sandbox or isolated environment to run untrusted or agent-generated code, running AI coding agents in…
datarobot-agent-assist
Use when the user wants to design, build, code, simulate, or deploy an AI agent (not a predictive model) to DataRobot; mentions agentspec.md, dr-assist, datarobot-agent-assist, dress rehearsal, swarm simulation, or the DataRobot agent template; wants to scaffold a LangGraph, CrewAI, LlamaIndex, NAT, or Base agent…
datarobot-agent-assist-build
Use when the user wants to design, build, code, or deploy an AI agent on DataRobot; mentions agentspec.md, dress rehearsal, the DataRobot agent template, LangGraph, CrewAI, LlamaIndex, NAT, Base agents, MCP servers, backend APIs, custom frontends, or the DataRobot CLI.
datarobot-workload-api
Use when the user wants to create, configure, scale, debug, observe, or roll out container workloads on DataRobot's Workload API. Triggers include: deploying a container as a managed service, listing/starting/stopping workloads, changing replica counts or autoscaling, picking CPU/GPU compute bundles, injecting…
datarobot-model-explainability
Tools and guidance for model explainability, prediction explanations, feature impact analysis, SHAP values, SHAP distributions, anomaly assessment, and model diagnostics. Use when analyzing model explanations, feature impact, SHAP values, SHAP distributions, anomaly assessment, or diagnosing model behavior.