event-management
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface for indirect prompt injection through the ingestion of external monitoring data.
- Ingestion points: Raw data enters the system from external monitoring tools (Nagios, SCOM, etc.) into the
em_eventtable. - Boundary markers: None identified in the provided JavaScript snippets for processing external strings.
- Capability inventory: The skill uses
snow_execute_script,snow_query_table, andsnow_create_event(SKILL.md). - Sanitization: There is a
try...catchblock for JSON parsing, but no explicit escaping or sanitization when concatenating event fields likedescription. - [DYNAMIC_EXECUTION]: The skill demonstrates legitimate dynamic execution patterns required for ServiceNow automation.
- Execution tool: The skill utilizes
snow_execute_scriptto run ServiceNow GlideScript on the instance (SKILL.md). - Stored scripts: The skill provides examples of Advanced Scripts stored in database fields (
em_event_rule.script) which are executed dynamically by the ServiceNow platform to process incoming events.
Audit Metadata