reddit-cultivate — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited reddit-cultivate (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build and maintain Reddit presence by controlling the user's real Chrome browser via AppleScript. No Playwright, no Selenium, no API tokens.
Claude Code → osascript → Chrome (real browser, logged in) → RedditChrome multi-profile can cause AppleScript to not see windows. Always detect first:
WINDOWS=$(osascript -e 'tell application "Google Chrome" to return count of windows' 2>/dev/null)
if [ "$WINDOWS" = "0" ] || [ -z "$WINDOWS" ]; then
echo "Use Method 2 (System Events + Console)"
else
echo "Use Method 1 (execute javascript)"
fiWorks when count of windows > 0.
osascript -e 'tell application "Google Chrome" to tell active tab of first window to set URL to "https://www.reddit.com/r/SideProject/rising/"'# Run JS that writes result to document.title
osascript -e 'tell application "Google Chrome" to tell active tab of first window to execute javascript "fetch(\"/api/me.json\",{credentials:\"include\"}).then(r=>r.json()).then(d=>{document.title=\"R:\"+JSON.stringify({name:d.data.name,karma:d.data.total_karma})})"'
# Wait, then read title
sleep 2
osascript -e 'tell application "Google Chrome" to return title of active tab of first window'osascript -l JavaScript -e '
var chrome = Application("Google Chrome");
var tab = chrome.windows[0].activeTab;
tab.execute({javascript: "(" + function() {
// Complex JS here — no escaping needed
fetch("/r/SideProject/rising.json?limit=10", {credentials: "include"})
.then(r => r.json())
.then(d => {
var posts = d.data.children.map(p => ({
title: p.data.title.substring(0, 60),
score: p.data.score,
comments: p.data.num_comments,
id: p.data.name,
url: "https://reddit.com" + p.data.permalink
}));
document.title = "POSTS:" + JSON.stringify(posts);
});
} + ")();"});
'When AppleScript can't see Chrome windows (multi-profile bug), use keyboard automation.
python3 -c "
import subprocess
js = '''(async()=>{
let resp = await fetch('/api/me.json', {credentials: 'include'});
let data = await resp.json();
document.title = 'R:' + JSON.stringify({name: data.data.name, karma: data.data.total_karma});
})()'''
subprocess.run(['pbcopy'], input=js.encode(), check=True)
"osascript -e '
tell application "System Events"
tell process "Google Chrome"
set frontmost to true
delay 0.3
-- Cmd+Option+J = open/close Console
key code 38 using {command down, option down}
delay 1
-- Select all + Paste + Enter
keystroke "a" using {command down}
delay 0.2
keystroke "v" using {command down}
delay 0.5
key code 36
delay 0.3
-- Close Console
key code 38 using {command down, option down}
end tell
end tell'sleep 3
osascript -e '
tell application "System Events"
tell process "Google Chrome"
return name of window 1
end tell
end tell'Get username, karma, verify login using /api/me.json.
For each target subreddit, fetch rising posts:
/r/{subreddit}/rising.json?limit=10Look for:
Rules:
Get modhash, then post each comment with 4s delay between posts.
// Get modhash first
let me = await fetch("/api/me.json", {credentials: "include"}).then(r=>r.json());
let uh = me.data.modhash;
// Post comment
let body = new URLSearchParams({
thing_id: "t3_xxxxx", // post fullname
text: "Your comment here",
uh: uh,
api_type: "json"
});
let resp = await fetch("/api/comment", {
method: "POST",
credentials: "include",
headers: {"Content-Type": "application/x-www-form-urlencoded"},
body: body.toString()
});
let result = await resp.json();
document.title = "POSTED:" + JSON.stringify(result);Extract the comment ID from the response HTML: look for id-t1_XXXXXXX in the result.
ALWAYS end with a summary table containing direct links to every comment posted.
The comment link format is:
https://www.reddit.com/r/{subreddit}/comments/{post_id}/comment/{comment_id}/Where:
{subreddit} = the subreddit name{post_id} = the post ID (from thing_id minus the t3_ prefix){comment_id} = extracted from the POST response (the t1_XXXXXXX value, minus t1_ prefix)Example summary table:
| # | Sub | Post | Comment Link |
|---|---|---|---|
| 1 | r/SideProject | "Post title" | https://www.reddit.com/r/SideProject/comments/abc123/comment/xyz789/ |
| 2 | r/ClaudeAI | "Post title" | https://www.reddit.com/r/ClaudeAI/comments/def456/comment/uvw012/ |
This lets the user bookmark, follow up on replies, and track which comments got traction.
| Priority | Subreddit | Why |
|---|---|---|
| High | r/SideProject | Project launches, very welcoming |
| High | r/indiehackers | Revenue/growth discussions |
| Medium | r/ClaudeAI | AI tooling audience |
| Medium | r/coolgithubprojects | Open source visibility |
| Medium | r/startups | Startup discussions |
| Medium | r/entrepreneur | Business insights |
| Medium | r/opensource | Technical audience |
| Action | Limit |
|---|---|
| Between API calls | 2+ seconds |
| Between posts | 4+ seconds |
| Per session | Max 5 comments |
| Daily | 10-15 comments max |
| Karma | Unlocks |
|---|---|
| 100+ | Can post in most subreddits |
| 500+ | Reduced spam filter triggers |
| 1000+ | Trusted contributor status |
| 5000+ | Community recognition |
| Problem | Solution |
|---|---|
count of windows = 0 | Chrome multi-profile bug → use Method 2 |
| "Allow JavaScript" not working | Restart Chrome after enabling |
| Modhash expired | Re-fetch from /api/me.json |
| 403 response | Rate limited, wait 5+ minutes |
| Comment not appearing | Check for shadowban: visit profile in incognito |
| Tool | Problem |
|---|---|
| Playwright | Sets navigator.webdriver=true, detected instantly |
| Selenium | Same detection issue |
| Puppeteer | Same detection issue |
| curl + API | IP blocked by Reddit after few requests |
| AppleScript | Controls real Chrome, undetectable, cookies included |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.