The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill uses SN-Execute-Background-Script to perform administrative setup tasks, including variable counting and batch node creation. It also generates and inserts JavaScript snippets into sys_cb_topic_detail records which are executed by the ServiceNow platform's Virtual Agent engine at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill designs a conversational flow that ingests untrusted user input, creating a vulnerability surface. 1. Ingestion points: User input is retrieved using vaSystem.getLastUserMessage() in the 'Search Catalog Items' node (Step 4) and from collected variables in the submission script (Step 6). 2. Boundary markers: The scripts lack explicit delimiters or instructions to ignore instructions embedded within the user data. 3. Capability inventory: The configured topic can query catalog tables and execute order placement via the sn_sc.CatalogOrderHelper API. 4. Sanitization: No validation or escaping is applied to the user-supplied strings before they are used in GlideRecord queries or passed to the Service Catalog API.

multi-turn-ordering