ui-actions

Pass

Audited by Gen Agent Trust Hub on Aug 3, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Bash native tool and the SN-Execute-Background-Script MCP tool. These capabilities are used for local file management during development and for debugging server-side JavaScript logic within a ServiceNow environment, which is consistent with the skill's stated purpose for ServiceNow developers.
  • [EXTERNAL_DOWNLOADS]: The skill uses SN-Sync-Script-To-Local to facilitate the transfer of script content from a ServiceNow instance to the local development environment. This is a standard workflow for developers syncing remote code for local editing and version control.
  • [REMOTE_CODE_EXECUTION]: The skill includes instructions for creating sys_ui_action records that contain server-side and client-side scripts. It also uses the SN-Execute-Background-Script tool for testing these scripts. These are standard administrative functions in the ServiceNow platform and are documented here as part of a legitimate development lifecycle.
  • [CREDENTIALS_UNSAFE]: The skill mentions the requirement of roles like admin and personalize and interacting with security tables (sys_security_acl). However, it does not contain hardcoded credentials, instead advising on best practices for role-based access control and security validation.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 3, 2026, 02:23 PM
Security Audit — agent-trust-hub — ui-actions