health-safety-summarization
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and summarize workplace incident records, which involves ingesting data from ServiceNow tables that contain user-generated content.
- Ingestion points: Data is retrieved from the
sn_hr_hs_incident,sn_hr_hs_investigation, andsn_hr_hs_hazardtables, specifically reading fields likedescriptionandshort_description. - Boundary markers: The instructions do not explicitly define delimiters to isolate the retrieved incident data from the agent's processing instructions.
- Capability inventory: The skill has access to administrative tools including
SN-Execute-Background-Script,Bash, and various ServiceNow REST API endpoints. - Sanitization: The provided aggregation scripts use standard ServiceNow logic to process data, but no explicit sanitization or escaping of the raw text fields is performed before the summary generation.
Audit Metadata