saas-user-resolution
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows standard practices for ServiceNow Software Asset Management, utilizing intended tools and API endpoints to manage SaaS subscriptions.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting external data into reports. 1. Ingestion points: Data is retrieved from ServiceNow tables samp_saas_user and sys_user via SN-Query-Table and REST APIs (SKILL.md). 2. Boundary markers: The reporting templates use bracketed placeholders for data interpolation but do not include explicit 'ignore' instructions for the agent. 3. Capability inventory: The skill uses structured query tools and read-only API access. 4. Sanitization: The instructions do not specify explicit data sanitization or filtering steps before interpolation.
Audit Metadata