major-incident-email
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external ServiceNow incident records, which represents a surface for indirect prompt injection.
- Ingestion points: Data is retrieved from the
incidenttable (short description, description) andsys_journal_fieldtable (work notes, comments) inSKILL.mdSteps 1 and 3. - Boundary markers: The generated email templates interpolate these fields directly into the output text without explicit delimiters or instructions to ignore embedded commands.
- Capability inventory: The skill has write access to ServiceNow via
SN-Update-Record,SN-Add-Work-Notes, andSN-Add-Commenttools, which could be abused if an injection is successful. - Sanitization: No sanitization or validation logic is specified for the external data before it is used by the agent to generate communications.
Audit Metadata