The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by processing untrusted data from chat logs. Adversarial instructions placed in a chat by a citizen could influence the agent's summarization or subsequent actions.
Ingestion points: Untrusted content is retrieved from the sys_journal_field and chat_queue_entry tables in SKILL.md.
Boundary markers: The skill lacks explicit delimiters or instructions to treat chat transcripts as untrusted data.
Capability inventory: The agent has access to the Bash tool and multiple ServiceNow data retrieval tools (SN-Query-Table, SN-Read-Record).
Sanitization: There is no evidence of filtering or sanitization of chat content before it is processed by the agent.
[DATA_EXFILTRATION]: The skill accesses sensitive personal information (PII) including citizen names, emails, phone numbers, and accessibility needs from the customer_contact and interaction tables. While this is consistent with the skill's stated purpose, it establishes a data exposure surface if the agent's instructions are compromised.

chat-summarization