vendor-management
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes vendor, contract, and risk assessment data from ServiceNow tables that could contain untrusted content or instructions. Ingestion points: ServiceNow data retrieved from tables like core_company, ast_contract, and vendor_risk_assessment via snow_query_table. Boundary markers: None identified in the provided example workflows or instructions. Capability inventory: snow_execute_script (server-side execution), snow_query_table, and snow_artifact_manage. Sanitization: The skill does not define specific methods for validating or sanitizing retrieved data before it is interpolated into prompts or scripts.
- [DYNAMIC_EXECUTION]: The skill relies on constructing ES5 JavaScript strings at runtime to be executed via the snow_execute_script tool, which constitutes a dynamic execution pattern used for ServiceNow integration.
Audit Metadata