fluent-sdk

SUSPICIOUS. The core NowSDK usage is coherent and largely benign, but the skill extends into live admin operations through an unrelated third-party MCP server that may handle ServiceNow credentials and runtime API traffic. No confirmed malware or covert exfiltration appears, yet the credential forwarding and high-impact automation make the overall skill medium risk.