app-generation

Pass

Audited by Gen Agent Trust Hub on Aug 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes curl commands within a Bash environment to interact with the ServiceNow Table API. These commands are used to programmatically create application components, utilizing standard environment variables ($SN_USER, $SN_PASS) for secure authentication.
  • [PROMPT_INJECTION]: The skill processes natural language requirements to generate executable business logic and access control rules, creating a potential surface for indirect prompt injection. 1. Ingestion points: Business requirements provided by users are used to drive code generation. 2. Boundary markers: Absent; the skill does not define specific delimiters or instructions to prevent the agent from executing instructions embedded within requirements. 3. Capability inventory: The skill can write to sensitive ServiceNow tables including sys_script (Business Rules) and sys_security_acl (Access Control Lists). 4. Sanitization: Absent; the skill lacks automated validation or sanitization logic for user requirements before they are incorporated into generated scripts.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 3, 2026, 02:24 PM
Security Audit — agent-trust-hub — app-generation