hr-email-recommendation
Warn
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
SN-Execute-Background-Scripttool, which allows server-side JavaScript execution on the ServiceNow instance. In Step 6 and Example 3, external data such as email drafts and case IDs are interpolated directly into script blocks (e.g.,var emailDraft = '[paste email draft text here]';). This pattern is vulnerable to command injection if the interpolated content contains characters that escape the string literal (such as a single quote followed by code), potentially allowing the execution of arbitrary JavaScript on the server.\n- [PROMPT_INJECTION]: The skill exhibits a vulnerability to indirect prompt injection (Category 8) due to its processing of untrusted input from HR cases to generate communications.\n - Ingestion points: Untrusted content is retrieved from ServiceNow tables in Step 1 (
sn_hr_core_case.description) and Step 2 (sys_email.body_text).\n - Boundary markers: The skill lacks explicit delimiters or instructions to the agent to treat retrieved case data as untrusted or to ignore embedded instructions during the response generation phase.\n
- Capability inventory: The agent possesses significant capabilities, including record updates (
SN-Update-Record), documentation via work notes (SN-Add-Work-Notes), and server-side script execution (SN-Execute-Background-Script).\n - Sanitization: While the skill provides a regex-based PII detection mechanism, it does not include sanitization or validation to prevent malicious instructions within case descriptions from influencing the agent's behavior or output.
Audit Metadata