business-rules
Pass
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
SN-Execute-Background-Scripttool to run JavaScript code on the server side of the ServiceNow platform. This is a legitimate administrative function used here for testing and simulating record operations. - [REMOTE_CODE_EXECUTION]: The skill provides templates for creating Business Rules (server-side scripts) by writing to the
sys_scripttable using theSN-Create-Recordtool. This functionality is the primary purpose of the skill and follows standard platform development practices. - [DATA_EXFILTRATION]: An example in Phase 1 demonstrates the use of ServiceNow's native
RESTMessageV2API to send incident data to a pre-defined external service. This is documented as a standard integration pattern for outbound notifications. - [COMMAND_EXECUTION]: The skill uses
SN-Sync-Script-To-LocalandSN-Sync-Local-To-Scripttools to manage code between the ServiceNow instance and the local file system. This is a standard workflow for developers using external IDEs and is authorized in the skill's tool manifest.
Audit Metadata