The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill generates and executes server-side JavaScript via the SN-Execute-Background-Script tool in Step 5 and Example 3. This allows the execution of arbitrary GlideRecord scripts on the connected ServiceNow environment to aggregate and process data. While these scripts are provided as templates, the capability to execute locally-generated code on a remote system represents a significant control surface.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and summarizes untrusted user data from ServiceNow journal fields.
Ingestion points: Data is retrieved from the sys_journal_field table (work notes and additional comments) in Step 2.
Boundary markers: No clear delimiters or instructions are provided to the agent to distinguish between administrative instructions and the data being summarized.
Capability inventory: The skill possesses write capabilities including SN-Update-Record and SN-Add-Work-Notes, and high-privilege execution via SN-Execute-Background-Script.
Sanitization: The skill uses a basic regex (/<[^>]*>/g) to strip HTML tags from notes, but this does not mitigate natural language instructions intended to influence the agent's behavior during summarization.
[COMMAND_EXECUTION]: The skill requires access to powerful tools like SN-Execute-Background-Script and Bash. The use of these tools is documented for legitimate administrative purposes, but their high-privilege nature increases the risk if the skill's instructions are subverted.

hr-sidebar-summarization