spoke-generation
Warn
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to generate JavaScript code for ServiceNow script steps. This code is stored in the sys_hub_script_step table and executed within the ServiceNow environment.
- [CREDENTIALS_UNSAFE]: The procedure involves creating records in the sys_alias_credential and sys_connection_alias tables, which manage sensitive authentication secrets.
- [PROMPT_INJECTION]: The skill processes untrusted integration requirements to generate code and configuration, creating an indirect prompt injection surface.
- Ingestion points: Integration requirements analysis (Step 1).
- Boundary markers: Absent. No instructions are provided to the agent to delimit or ignore instructions within the requirement data.
- Capability inventory: Record creation and modification via SN-Create-Record and SN-Update-Record tools.
- Sanitization: Absent. There is no mention of escaping or validating requirement data before it is used in record creation or script generation.
Audit Metadata