community-outreach
Warn
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: MEDIUMPERSISTENCECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PERSISTENCE]: The
scripts/setup_scheduler.pyscript enables the skill to maintain access across sessions by installing itself as a daily background task. It supports creating tasks in the Windows Task Scheduler (schtasks) and provides configuration for Unixcronjobs. Additionally, it modifies the agent platform's private configuration file (~/.gemini/config/config.json) to register sidecar tasks. - [COMMAND_EXECUTION]: The
scripts/setup_scheduler.pyscript utilizessubprocess.runto call the system'sschtasksutility. This allows the skill to programmatically manage (create or delete) system-level scheduled tasks, which is a powerful capability for modifying the host environment's execution schedule. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external comments from public threads (Reddit, YouTube, forums) to adapt the tone and length of its drafted recommendations. This creates a surface where malicious instructions embedded in forum posts could influence the agent's drafting process.
- Ingestion points: External forum and social media comments are processed during the research phase (
phase3_research_and_stageinoutreach_engine.py). - Boundary markers: While the skill emphasizes human-in-the-loop review as a safety guarantee, the core logic does not show technical boundary markers or specific 'ignore instructions' warnings for the ingested external data.
- Capability inventory: The skill can draft outreach posts, write to the workspace filesystem, and potentially execute network operations if an external publisher is provided.
- Sanitization: Content is escaped for Markdown before being recorded in outbox and registry files to prevent injection within the markdown structure.
Audit Metadata