analytics-generation
Pass
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill translates natural language descriptions of business requirements into ServiceNow performance analytics and reporting configurations. This architectural pattern creates an indirect prompt injection surface where malicious instructions embedded in requirement data could influence system state.
- Ingestion points: Natural language descriptions of metrics, indicators, and dashboard requirements (Step 2, Step 5, Step 6).
- Boundary markers: None identified in the skill instructions to delimit untrusted input from system instructions.
- Capability inventory: Capability to create and modify records in ServiceNow PA tables (pa_indicators, pa_dashboards, pa_widgets, pa_data_collectors) and reporting tables (sys_report).
- Sanitization: No sanitization or validation of the input data is described; the skill relies on the agent's interpretation.
- [EXTERNAL_DOWNLOADS]: The skill performs network requests to ServiceNow API endpoints (
/api/now/table/*) to manage performance analytics data, which is consistent with the skill's stated purpose and targets a well-known enterprise service. - [COMMAND_EXECUTION]: The skill provides bash examples utilizing curl for direct API interactions. These examples use environment variables ($SN_USER, $SN_PASS) for authentication, which is a recommended practice for secret management.
Audit Metadata