data-quality
Pass
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill leverages the
SN-Execute-Background-Scripttool to perform complex server-side data analysis on the ServiceNow instance, including duplicate detection and health assessments. This matches the intended administrative scope and uses official platform capabilities. - [DATA_EXFILTRATION]: Includes code examples in
SKILL.md(Example 1) for sending quality reports via email using theGlideEmailOutboundAPI. This is a routine operational task for generating notifications and reports within the enterprise environment. - [PROMPT_INJECTION]: Identifies an indirect prompt injection surface where the agent processes data from ServiceNow tables. 1. Ingestion points: Data retrieved from
cmdb_ciand related tables inSKILL.md(Steps 1-6). 2. Boundary markers: Absent; CI attributes are processed without delimiters to separate them from instructions. 3. Capability inventory: The skill can modify data and execute scripts viaSN-Update-Record,SN-Create-Record, andSN-Execute-Background-Scriptas documented acrossSKILL.md. 4. Sanitization: Absent; records are handled via standard GlideRecord API calls without specific filtering for potentially malicious prompt content embedded in fields like CI names or comments.
Audit Metadata