The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from multiple ServiceNow tables (e.g., issues, controls, risks) that can be populated by various users. This data is used to generate remediation task descriptions and influences the logic of suggested actions.
Ingestion points: Data retrieved from sn_grc_issue, sn_compliance_control, and sn_grc_risk tables via the SN-Get-Record and SN-Query-Table tools.
Boundary markers: Absent. The instructions do not specify any delimiters or safety warnings for the agent when processing data from these external records.
Capability inventory: The skill has access to SN-Execute-Background-Script (server-side JavaScript execution) and SN-Create-Record (database write operations).
Sanitization: Absent. Data from the GRC records (like descriptions and short descriptions) is concatenated directly into task recommendations and summaries without evidence of escaping or validation.
[COMMAND_EXECUTION]: The skill uses Bash for REST API interactions and SN-Execute-Background-Script to perform complex GRC logic. These tools provide significant control over the ServiceNow environment and the local shell, which are intended for administrative or manager roles but represent a high-privilege capability.
[DYNAMIC_EXECUTION]: The skill provides a detailed JavaScript template to be executed via SN-Execute-Background-Script. While the logic is specific to GRC remediation, the pattern of generating and executing code based on database records is a dynamic execution surface.

suggest-remediation-tasks