issue-validator
Warn
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the SN-Execute-Background-Script tool to run server-side JavaScript code. This is a high-privilege operation that allows complex logic execution within the target environment.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its ingestion of ServiceNow record data.\n
- Ingestion points: Processes data from the sn_grc_issue table, specifically description and short_description fields in SKILL.md.\n
- Boundary markers: No specific boundary markers or instructions to ignore embedded commands are present.\n
- Capability inventory: The agent has access to SN-Execute-Background-Script, SN-Query-Table, and Bash.\n
- Sanitization: The skill does not perform sanitization or filtering on the retrieved record content.\n- [DATA_EXFILTRATION]: The skill targets sensitive Governance, Risk, and Compliance tables, exposing risk ratings, control effectiveness, and remediation plans.
Audit Metadata