regulatory-alert-analysis
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill leverages the
SN-Execute-Background-Scripttool to perform complex server-side data aggregation and impact analysis within ServiceNow. This is a legitimate use of administrative tools for processing high-volume GRC data that exceeds the capabilities of standard table APIs. - [PROMPT_INJECTION]: The skill identifies a potential surface for indirect prompt injection by processing external regulatory alert data (e.g., alert descriptions).
- Ingestion points: Data is retrieved from the
descriptionandshort_descriptionfields of thesn_regulatory_alerttable inSKILL.md(Step 1 and Step 5). - Boundary markers: The instructions do not specify explicit delimiters for the agent to distinguish between external alert text and internal processing logic.
- Capability inventory: The skill has access to
SN-Execute-Background-Script,SN-Create-Record, andSN-Update-Record, which allow for significant platform modification. - Sanitization: There is no explicit validation or sanitization shown for the ingested alert content before it is processed by the background scripts.
Audit Metadata