skills/happy-technologies-llc/happy-platform-skills/contract-metadata-extraction/Gen Agent Trust Hub
contract-metadata-extraction
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
SN-Execute-Background-Scripttool, which allows the execution of arbitrary server-side JavaScript (GlideScript) within a ServiceNow instance. While this is a standard administrative tool in ServiceNow and its use aligns with the skill's primary purpose of complex metadata extraction, it represents a high-capability execution path. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to the processing of untrusted data from contract records and attachments.
- Ingestion points: Contract content retrieved from
clm_contract_docand file attachments fromsys_attachment(Steps 2 and 5). - Boundary markers: Absent; the skill does not use delimiters or instructions to ignore embedded commands within the processed text.
- Capability inventory: Includes record creation (
SN-Create-Record), record updates (SN-Update-Record), and server-side script execution (SN-Execute-Background-Script). - Sanitization: Absent; external content is not sanitized or validated before being included in the agent's context or used in automated logic.
Audit Metadata