reporting-dashboards

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external ServiceNow tables, which serves as an ingestion point for potentially untrusted content. * Ingestion points: The snow_query_table tool and GlideRecord queries to tables such as incident and task_sla. * Boundary markers: No delimiters or instructions are provided in the documentation to isolate data from agent instructions. * Capability inventory: The skill utilizes tools to create reports, build dashboards, and schedule automated email deliveries (snow_schedule_report_delivery). * Sanitization: No sanitization or validation logic is demonstrated for data retrieved from tables before being used in report generation.
  • [METADATA_POISONING]: An inconsistency exists between the tools declared in the frontmatter and those described in the technical documentation sections. * Evidence: The YAML frontmatter identifies the tool as snow_schedule_report_delivery, while the 'MCP Tool Integration' section and code examples reference a different tool structure, snow_pa_create, for the same scheduling functionality.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 08:04 PM
Security Audit — agent-trust-hub — reporting-dashboards