oa-daily-report

Warn

Audited by Gen Agent Trust Hub on Mar 23, 2026

Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
  • [PRIVILEGE_ESCALATION]: The skill requires administrator privileges to create or delete Windows scheduled tasks. This is a high-privilege operation that allows the skill to modify system-level configurations and task schedules.
  • [PERSISTENCE]: The setup_reminder.ps1 script registers a daily scheduled task (schtasks /Create) that ensures the daily_reminder.ps1 script runs at a set time every day. This is a persistence mechanism used to maintain the reminder functionality across system reboots.
  • [COMMAND_EXECUTION]: The scripts execute system-level commands including schtasks and Start-Process. Specifically, Invoke-Expression is used in setup_reminder.ps1 and remove_reminder.ps1 to run dynamically constructed command strings, which is a practice that can be susceptible to command injection if parameters were manipulated.
  • [DYNAMIC_EXECUTION]: The daily_reminder.ps1 script uses Add-Type to dynamically load .NET assemblies (System.Windows.Forms, System.Drawing) into the PowerShell session at runtime. Additionally, the scheduled task is configured to run PowerShell with -ExecutionPolicy Bypass and -WindowStyle Hidden, allowing the script to execute silently regardless of the system's default execution policy.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 23, 2026, 12:49 PM