Agent Reach

Agent Reach has no identity of its own: the host agent runs the upstream tools with the user's existing logins, so the zero-config GitHub channel uses whatever gh login the user has, with full read and write. Credential imports for other platforms are explicit and narrow (only the named cookies for one chosen platform, and install never reads a browser), which is a real narrowing. But every tool Agent Reach launches inherits the full environment, and nothing checks what a request is allowed to do.

Agent Reach ships no approval step of its own. Its installer is check-only unless the --system flag is passed, and it has a dry run, but that flag is passed by the agent itself once it decides the user agreed, so the gate is the model's judgement. The skill says it is for reading only, yet its GitHub reference lists commands that create issues, pull requests, repositories and releases with no risk marking. Anything consequential relies entirely on the host agent's own permission prompts.

Agent Reach's own commands validate their inputs reasonably: transcription and its web reader reject non-public literal addresses, config keys are a fixed list, and responses and downloads are size-capped. But the skill routes the real work through general tools, raw curl on any URL, the full gh CLI and API, yt-dlp and shell one-liners, which Agent Reach does not check at all. The URL checks cover literal addresses only and do not follow redirects or DNS. Optional channels are opt-in one by one, but the default set already includes GitHub write and arbitrary fetch.

Agent Reach provides no isolation. The skill has the host agent run shell commands, including Python one-liners and podcast scripts, directly on the user's machine, and the installer runs global npm and pipx installs, whose install scripts execute as the user. Nothing runs in a container or sandbox, so anything that goes wrong has the user's files, network and logins.

Agent Reach exists to pour untrusted internet content (web pages, tweets, Reddit, YouTube comments, search results) into an agent that also holds the user's GitHub login and can fetch any URL. Neither the skill nor the install guide marks fetched content as untrusted, records where it came from, or limits what the agent may do after reading it. A prompt injection in any page can therefore steer the agent to leak data through a URL and act on the user's GitHub account without Agent Reach involving a human.

Agent Reach keeps no memory, but two things persist into later sessions without review. Its settings file, including the network proxy that the guides tell agents to export before running tools, can be rewritten by the agent with a plain command. And the search command the skill runs reads MCP server definitions from the current working directory as well as the user's home, so a file in the workspace can change which server starts, with no trust decision. The skill itself is installed only into user-level skill folders, which is good.

Agent Reach is an installer for third-party tools, and most of what it installs is unpinned: mcporter, undici and OpenCLI come from global npm installs at whatever version is latest, twitter-cli and bilibili-cli from PyPI likewise, and the setup and update guides the agent follows are read from the main branch. Two Python CLIs are pinned to exact commits, which helps, but nothing is checked against a hash or signature. Installs need the --system flag, which the agent passes itself. Everything installed runs as the user with full access.

Agent Reach handles the secrets it stores carefully: the settings file is written atomically with owner-only permissions and refuses symlinks, secret settings are masked when shown, error and doctor output is scrubbed of credentials in URLs, values can be entered through a hidden prompt, and there is no telemetry. The weak spot is the setup flow: the install guide asks users to paste cookies and API keys to the agent, and the Twitter instructions have the agent put tokens in shell commands, so those secrets pass through the model provider. Tokens are long-lived and stored in plain text.

Agent Reach keeps no record of what the agent did with it. There is no audit log of installs, configuration changes or the upstream commands the skill directs, and its own logging is switched off unless --verbose is passed, and then only goes to the terminal. Reconstructing an incident depends entirely on the host agent's transcript.

Agent Reach's own commands are well bounded: every subprocess it starts has a timeout, transcription caps file size, audio length and number of chunks, and its web reader caps response size. But those bounds cover only Agent Reach's own commands; the curl, yt-dlp, gh and social-media commands the skill sends the agent to run have no limits from Agent Reach, and the skill encourages fetching from several platforms in parallel. The install guide also suggests a daily scheduled check that keeps running after a session ends.