The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the SN-Execute-Background-Script tool (Steps 6 and 7) to run arbitrary JavaScript on the target ServiceNow instance. The procedure relies on the agent dynamically populating variable values, such as eventNumber, within the script body. This pattern is vulnerable to script injection where a malicious user or data source could provide input that breaks out of the intended string literal to execute unauthorized code on the remote server.
[REMOTE_CODE_EXECUTION]: By instructing the agent to construct and execute server-side scripts to perform aggregation logic, the skill creates a remote code execution surface on the ServiceNow platform. This is a high-privilege operation (requiring the admin role as stated in prerequisites) that grants the agent significant autonomy over the target system's environment and data.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its ingestion of untrusted data from the sys_journal_field table (work notes) in Step 4. This field contains free-text comments authored by ServiceNow users.
Ingestion points: Data is fetched from sys_journal_field via the SN-Query-Table tool.
Boundary markers: The instructions do not define boundary markers or delimiters (e.g., XML tags or clear labels) to separate the retrieved content from the agent's instructions.
Capability inventory: The agent has the ability to write to the file system (via Bash), execute server-side scripts on ServiceNow, and perform extensive network-based database queries.
Sanitization: There is no mention of filtering, escaping, or validating the journal content before it is processed by the agent's context, allowing embedded instructions in a work note to potentially influence the agent's logic.

risk-event-summarization