The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines templates for ServiceNow scripts that interpolate data from external variables (e.g., workOrderSysId, tasks[i].description, statusUpdate.notes) into GlideRecord operations. If the agent processes untrusted data as input for these fields, there is a minor risk that specially crafted content could influence the logic of the generated scripts or the data written to the ServiceNow instance.
Ingestion points: Inputs to createWorkOrderTasks, updateWorkOrderFromMobile, and recordTimeEntry in SKILL.md.
Capability inventory: Uses snow_execute_script to run server-side JavaScript on ServiceNow.
Sanitization: The provided snippets do not show explicit input validation or escaping before setting values via setValue or work_notes.
[COMMAND_EXECUTION]: The skill relies on the snow_execute_script tool to perform administrative and operational tasks within a ServiceNow environment. This is a functional requirement for managing FSM workflows but grants the agent the ability to execute code within the target ServiceNow instance's scope.

field-service