The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from ServiceNow cases to generate knowledge articles. Malicious instructions could be embedded within case records by customers or agents.
Ingestion points: The skill reads from the sn_customerservice_case table (fields like short_description, description, close_notes) and the sys_journal_field table (work notes and comments) in SKILL.md (Steps 2 and 3).
Boundary markers: Absent. The skill does not use specific delimiters or instructions to ignore embedded commands when processing case text.
Capability inventory: The skill utilizes SN-Create-Record, SN-Update-Record, SN-Execute-Background-Script, and Bash tools.
Sanitization: No sanitization, escaping, or validation of the ingested external content is described.
[REMOTE_CODE_EXECUTION]: The skill includes the SN-Execute-Background-Script tool in its configuration and mentions its use for batch-generating articles in the Tool Usage reference. This tool allows for the execution of arbitrary server-side JavaScript within the ServiceNow environment, which represents a high-risk capability if misused.
[COMMAND_EXECUTION]: The skill lists Bash as a native tool and provides numerous examples of performing REST operations via curl inside bash code blocks. This provides the agent with local shell execution capabilities.
[DATA_EXFILTRATION]: The skill accesses sensitive data tables including sn_customerservice_case, interaction, and csm_consumer. These tables typically contain Personally Identifiable Information (PII) such as customer names, contact details, and specific issue histories. While necessary for the skill's function, this level of access constitutes a significant data exposure risk.

csm-kb-generation