skills/happy-technologies-llc/happy-platform-skills/risk-assessment-summarization/Gen Agent Trust Hub
risk-assessment-summarization
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from ServiceNow tables which may contain instructions intended to influence the model's summarization behavior.
- Ingestion points: Data is retrieved from tables such as
sn_grc_risk,sn_risk_definition, andsn_risk_event(SKILL.md). - Boundary markers: The skill does not implement delimiters or 'ignore' instructions when interpolating retrieved data into the summary generation process.
- Capability inventory: The skill possesses the capability to query database records and execute server-side JavaScript analysis scripts via
SN-Execute-Background-Script. - Sanitization: There is no evidence of sanitization, escaping, or validation of the retrieved database field content before processing.
- [DYNAMIC_EXECUTION]: The skill utilizes
SN-Execute-Background-Scriptto perform complex data operations on the ServiceNow instance. - Evidence: Multi-line JavaScript templates are provided in Steps 3 through 6 (SKILL.md) to calculate metrics like control effectiveness and risk trends at runtime.
Audit Metadata