update-set-management
Pass
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs legitimate administrative tasks using authorized tools such as SN-Create-Record, SN-Query-Table, and SN-Execute-Background-Script. These operations are standard for ServiceNow configuration management and are scoped to users with admin or update_set_admin roles.
- [PROMPT_INJECTION]: The skill processes untrusted data which presents a surface for indirect prompt injection. 1. Ingestion points: The agent reads the payload field from the sys_update_xml table in SKILL.md (Step 7). 2. Boundary markers: None are used to delimit the configuration payload from the agent's instructions. 3. Capability inventory: The skill has access to powerful tools including SN-Execute-Background-Script (server-side JS execution), Bash, and various record modification tools. 4. Sanitization: The skill mitigates this risk by providing a 'Validation Checklist' for the user to manually inspect payloads for credentials and hardcoded values before proceeding with migration.
Audit Metadata