The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's procedure in Step 6 utilizes the SN-Execute-Background-Script tool to run arbitrary JavaScript on the remote ServiceNow instance. This tool is designed for administrative script execution and carries inherent risk when used by an automated agent to process untrusted or dynamic data.
[REMOTE_CODE_EXECUTION]: The skill provides a server-side script template that is executed on the ServiceNow platform. Because this script incorporates data from incident records (such as incident numbers), it creates a vector for remote code execution if the agent or the source data is compromised.
[DATA_EXFILTRATION]: The skill provides instructions to access and process highly sensitive security information, including data from the sn_si_incident, sn_ti_observable, and sn_vul_vulnerable_item tables. This exposure involves detailed threat indicators, vulnerability data, and organizational incident response posture.
[DATA_EXFILTRATION]: Ingestion points: Data from security incidents and threat observables are read into the agent's context in Steps 1 through 4. Boundary markers: The skill does not implement delimiters or 'ignore' instructions when interpolating retrieved data into the background script or work notes. Capability inventory: The skill has the ability to execute code (SN-Execute-Background-Script) and persist data (SN-Add-Work-Notes) on the ServiceNow platform. Sanitization: No sanitization, validation, or escaping of the retrieved incident data is performed before it is used in subsequent operations.

security-recommended-actions