release-notes-generation
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform REST API operations, specifically GET and POST requests, to interact with ServiceNow table APIs for retrieving and updating records.
- [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it retrieves data from external ServiceNow tickets and incorporates it into agent-generated content.
- Ingestion points: Data is queried from
change_request,rm_story,rm_defect, andincidenttables using theSN-Query-Tabletool and REST API calls (SKILL.md Steps 2-5). - Boundary markers: None. External data is interpolated directly into the release notes document template (SKILL.md Step 6) without delimiters or instructions to ignore embedded commands.
- Capability inventory: The skill can create new records in the knowledge base (
SN-Create-Record) and update existing release records (SN-Update-Record). - Sanitization: There is no evidence of validation or sanitization of the content retrieved from ticket fields before it is processed by the agent.
Audit Metadata