ise-incident-response
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill interacts with Cisco ISE and ServiceNow by executing local scripts via a command-line interface. This mechanism is the intended primary purpose of the skill and is constrained by environment variables providing the script paths.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external network endpoints and session logs which could contain malicious content. However, the risk is mitigated by strict human-in-the-loop requirements where the agent must present a summary and wait for an affirmative 'YES' before taking any action.
- [CREDENTIALS_SAFE]: The skill correctly handles sensitive credentials (ISE username and password) by referencing environment variables rather than hardcoding them, aligning with secret management best practices.
Audit Metadata