chat-recommendation
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external ServiceNow tables, which is an inherent attack surface for indirect prompt injection, though mitigated by the skill's design and read-only nature.
- Ingestion points: Untrusted data enters the context via
kb_knowledge(article text),sys_journal_field(journal entries/comments), andinteraction_entry(chat transcripts) as described inSKILL.md. - Boundary markers: The generation templates in
SKILL.mdutilize clear delimiters (e.g.,=== CHAT RESPONSE RECOMMENDATIONS ===) and categorical headers to separate retrieved data from the agent's instructions. - Capability inventory: The skill uses tools like
SN-Query-TableandSN-Get-Recordfor data retrieval only; it does not include instructions for automated file-system writes, network exfiltration, or shell execution based on the content of the retrieved records. - Sanitization: While no explicit sanitization logic is provided in the instructions, the skill encourages manual agent review of all generated recommendations before use, providing a human-in-the-loop safety checkpoint.
Audit Metadata