legal-matter-summarization
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes information retrieved from external ServiceNow tables (e.g.,
sn_legal_matter,sn_legal_case,sn_legal_task) that may contain untrusted user-generated content in fields likedescription,short_description, andwork_notes. This content is incorporated into summaries written back to the system. - Ingestion points: Data is ingested via
SN-Get-Record,SN-Query-Table, and REST GET calls as described in SKILL.md (Steps 1 through 6). - Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the ingested text before summarization.
- Capability inventory: The skill utilizes
SN-Update-RecordandSN-Add-Work-Notesto write summaries and metadata back to the ServiceNow instance. - Sanitization: No explicit sanitization, filtering, or validation steps are documented for handling potentially malicious instructions embedded in the record data.
Audit Metadata