The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the SN-Execute-Background-Script tool to run server-side GlideScript within ServiceNow. These scripts are provided as templates within the skill to automate time-based metric calculations for incident response analysis.
[DATA_EXFILTRATION]: The skill performs read operations on sensitive security tables, including sn_si_incident (Security Incidents), sn_ti_observable (Threat Intelligence), and sys_audit (Audit Logs). This data is gathered to generate analytical reports on SOC performance.
[PROMPT_INJECTION]: The skill processes external data from incident records which constitutes an ingestion surface for indirect prompt injection.
Ingestion points: Incident, task, and observable records retrieved via SN-Query-Table and SN-Execute-Background-Script tools (SKILL.md).
Boundary markers: Absent; the procedure does not implement specific delimiters or instructional warnings to prevent the agent from following directions potentially embedded in incident fields.
Capability inventory: SN-Execute-Background-Script (server-side script execution), Bash (shell command access), and SN-Add-Work-Notes (ability to write back to the system).
Sanitization: Absent; there is no defined logic to filter or sanitize the contents of queried fields before they are incorporated into the agent's context for reporting.

metrics-analysis