investigation-entrypoint
Warn
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation recommends that users install ServiceNow MCP servers from unverified GitHub repositories, specifically echelon-ai-labs/servicenow-mcp and michaelbuckner/servicenow-mcp. These are third-party sources not officially maintained by the service provider, which could lead to the installation of malicious or compromised code in the user environment.
- [COMMAND_EXECUTION]: The skill enables the agent to recommend and execute critical production commands for incident mitigation, such as kubectl rollout undo or traffic draining. While the instructions mandate a risk assessment and user confirmation, these actions have significant impact potential and require high-privilege access to Google Cloud environments.
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves analyzing untrusted data from production logs and monitoring events. This creates a surface for indirect prompt injection where malicious log entries could manipulate the agent's diagnostic logic or mitigation suggestions. \n
- Ingestion points: Production logs from Cloud Logging and metrics from Cloud Monitoring as referenced in the Data Collection & Deep Dive section of SKILL.md. \n
- Boundary markers: The instructions do not define specific delimiters or warnings for the agent to ignore instructions embedded within the logs. \n
- Capability inventory: The skill utilizes MCP tools to query and modify GKE clusters and Cloud Run services, along with subagent invocation. \n
- Sanitization: There is no evidence of log sanitization or validation protocols to prevent data-driven manipulation of the agent's reasoning.
Audit Metadata