The Agent Skills Directory

[PROMPT_INJECTION]: The skill possesses a vulnerability to indirect prompt injection as it ingests and processes untrusted data from ServiceNow records without adequate safety boundaries.
Ingestion points: Untrusted data enters the agent context via the change_request table fields, specifically short_description, description, change_plan, backout_plan, and test_plan as described in SKILL.md Step 1.
Boundary markers: Absent. The instructions do not use delimiters or explicit prompts to tell the model to ignore instructions embedded within the retrieved record data.
Capability inventory: The skill utilizes SN-Update-Record, SN-Create-Record, and native Bash shell access, which could be abused if an injection occurs.
Sanitization: Absent. There is no evidence of validation or filtering for the retrieved text data before it is interpolated into the reasoning process.
[COMMAND_EXECUTION]: The skill explicitly requests the native Bash tool in its configuration. While this is likely intended for local calculations or data processing, the availability of a shell environment significantly increases the risk profile if the agent is successfully targeted by a prompt injection attack.

change-risk-explanation