survey-analysis
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it retrieves and processes free-text survey responses from the
asmt_assessment_instance_questiontable without sanitization or boundary markers. - Ingestion points: Step 6 uses
SN-Query-Tableto fetchstring_valuecontent from survey response records. - Boundary markers: No explicit delimiters or instructions are provided to the agent to distinguish between system instructions and user-provided survey content.
- Capability inventory: The skill uses
SN-Execute-Background-ScriptandSN-Add-Work-Notes, which provide significant interaction with the ServiceNow environment. - Sanitization: No sanitization or filtering of the retrieved survey comments is described in the procedure.
- [COMMAND_EXECUTION]: The skill employs
SN-Execute-Background-Scriptto run complex JavaScript snippets for data aggregation. This allows for arbitrary server-side script execution within the ServiceNow instance, which is a powerful capability intended for administrators but requiring caution.
Audit Metadata