issue-validator

SUSPICIOUS: The skill’s purpose and ServiceNow data access are coherent for GRC validation, and there is no direct exfiltration or malware behavior in the skill text. Risk comes from reliance on powerful background-script execution and unverified third-party MCP tooling that may receive ServiceNow credentials and data, making this medium-risk rather than benign.