client-scripts
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides templates for ServiceNow client scripts that ingest untrusted user input from form fields using g_form.getValue() and onChange parameters. This data is subsequently processed or transmitted to server-side components.\n
- Ingestion points: Untrusted data enters the context via g_form.getValue() and the newValue parameter in onChange functions within SKILL.md.\n
- Boundary markers: The provided templates do not include specific delimiters or instructions to ignore embedded commands within user-supplied values.\n
- Capability inventory: The skill uses tools like snow_create_client_script and snow_create_script_include to implement the logic that processes this data.\n
- Sanitization: While a basic email regex validation is provided in the onSubmit pattern, comprehensive sanitization or output encoding is not detailed in the generic templates.
Audit Metadata