es5-compliance
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for the agent to ingest, validate, and convert JavaScript code for ServiceNow. This creates an indirect prompt injection surface where external scripts could contain instructions designed to influence the agent's behavior.
- Ingestion points: The agent reads and processes user-provided JavaScript code for syntax conversion and validation as described in SKILL.md.
- Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded prompts within the scripts being processed.
- Capability inventory: The skill utilizes the
snow_execute_scripttool, which allows for the execution of the converted code on ServiceNow instances. - Sanitization: The documentation does not specify methods for sanitizing or filtering instructions that might be embedded in code comments or string literals within the input scripts.
Audit Metadata