The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it retrieves and processes untrusted data from ServiceNow incident records to generate email communications.
Ingestion points: External data is ingested from the incident and sys_journal_field tables (specifically fields such as short_description, description, business_impact, and work_notes) using the SN-Read-Record and SN-Query-Table tools in SKILL.md.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore or isolate potentially malicious instructions embedded within the retrieved ServiceNow data.
Capability inventory: The skill environment includes tools with write capabilities such as SN-Update-Record, SN-Add-Work-Notes, SN-Add-Comment, and access to the Bash shell.
Sanitization: No sanitization, validation, or escaping of the ingested content is defined before the data is interpolated into the email templates.

major-incident-email