The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute curl commands for interacting with ServiceNow REST API endpoints (e.g., /api/now/table/sn_tprm_issue). These operations are used for legitimate data retrieval within the target platform's infrastructure.
[DYNAMIC_EXECUTION]: The skill employs the SN-Execute-Background-Script tool to run server-side GlideScript for complex data aggregation and reporting. The provided scripts are static templates used to calculate metrics like assessment gaps and remediation effectiveness. While this tool allows arbitrary code execution on the ServiceNow instance, its use here is consistent with advanced administrative tasks and requires appropriate platform permissions.
[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from ServiceNow tables, such as vendor issue descriptions and remediation plans. This creates a surface for indirect prompt injection.
Ingestion points: Data is retrieved from the sn_tprm_issue and sn_tprm_vendor_assessment tables, including free-text fields like short_description and description (SKILL.md, Step 1 & 6).
Boundary markers: The output template for work notes lacks explicit delimiters or instructions to ignore embedded commands within the summarized content.
Capability inventory: The agent has the ability to execute background scripts, query multiple tables, and write work notes back to the database (SKILL.md, Procedure section).
Sanitization: No explicit sanitization or filtering of the ingested database content is described before it is processed by the agent for summarization.

tprm-issue-summarization