community-outreach

Warn

Audited by Gen Agent Trust Hub on Nov 13, 2026

Risk Level: MEDIUMPERSISTENCECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [PERSISTENCE]: The scripts/setup_scheduler.py script enables the skill to maintain access across sessions by installing itself as a daily background task. It supports creating tasks in the Windows Task Scheduler (schtasks) and provides configuration for Unix cron jobs. Additionally, it modifies the agent platform's private configuration file (~/.gemini/config/config.json) to register sidecar tasks.
  • [COMMAND_EXECUTION]: The scripts/setup_scheduler.py script utilizes subprocess.run to call the system's schtasks utility. This allows the skill to programmatically manage (create or delete) system-level scheduled tasks, which is a powerful capability for modifying the host environment's execution schedule.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external comments from public threads (Reddit, YouTube, forums) to adapt the tone and length of its drafted recommendations. This creates a surface where malicious instructions embedded in forum posts could influence the agent's drafting process.
  • Ingestion points: External forum and social media comments are processed during the research phase (phase3_research_and_stage in outreach_engine.py).
  • Boundary markers: While the skill emphasizes human-in-the-loop review as a safety guarantee, the core logic does not show technical boundary markers or specific 'ignore instructions' warnings for the ingested external data.
  • Capability inventory: The skill can draft outreach posts, write to the workspace filesystem, and potentially execute network operations if an external publisher is provided.
  • Sanitization: Content is escaped for Markdown before being recorded in outbox and registry files to prevent injection within the markdown structure.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Nov 13, 2026, 05:44 AM