The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill defines functions such as executeMIDScript, executeRemotePowerShell, and executeRemoteSSH that are specifically designed to package and transmit code for execution on remote ServiceNow MID Servers and connected target hosts.
[COMMAND_EXECUTION]: The skill facilitates the execution of operating system commands (e.g., df -h /), PowerShell scripts, and SSH commands via the ServiceNow ecc_queue architecture.
[DYNAMIC_EXECUTION]: The skill uses dynamic script generation, constructing XML payloads containing executable code (JavaScript for JSProbes or PowerShell/SSH scripts) at runtime based on provided parameters.
[INDIRECT_PROMPT_INJECTION]: The skill includes logic to monitor and process responses from external infrastructure, creating a potential surface for indirect prompt injection if the agent relies on unverified data returned from the MID Server.
Ingestion points: The waitForECCResponse function queries the ecc_queue table for input records (responses from the MID Server).
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the scripts that process external data.
Capability inventory: The skill possesses the capability to write to the ecc_queue (output) and includes tools for querying tables and executing scripts within the ServiceNow environment.
Sanitization: While the skill performs basic XML entity escaping in the escapeXML function, there is no validation or sanitization of the content received back from the MID Server before it is returned to the agent context.

mid-server