notifications
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill utilizes tools like
SN-Execute-Background-Scriptand createssys_script_emailrecords, both of which involve executing arbitrary server-side JavaScript (GlideScript) within the ServiceNow environment. - [INDIRECT_PROMPT_INJECTION]: The skill manages the creation of email templates and mail scripts using potentially untrusted input data. Ingestion points: Data enters via templates and script creation tools in SKILL.md. Boundary markers: Absent. Capability inventory: Uses
SN-Execute-Background-Script,SN-Create-Record, andSN-Update-Record. Sanitization: No validation or filtering of external content is specified. - [COMMAND_EXECUTION]: The skill manifest includes
Bashas a native tool, which allows the agent to execute shell commands, although no specific shell commands are provided in the guide steps.
Audit Metadata