ui-generation
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill correctly identifies and uses official ServiceNow REST API endpoints and MCP tools to interact with system tables such as sys_script_client, sp_widget, and sys_ui_page. The generated code examples follow ServiceNow best practices, such as using the g_form API, implementing isLoading guards in onChange scripts, and using GlideAjax for server-side lookups.
- [PROMPT_INJECTION]: The skill facilitates the generation of executable code (JavaScript and Jelly/XML) from untrusted natural language input, creating a potential surface for indirect prompt injection. However, this is inherent to the primary function of a UI generation tool and the skill does not contain instructions to bypass safety filters or ignore system constraints.
- Ingestion points: Natural language descriptions of UI requirements.
- Boundary markers: Not specified in the skill instructions.
- Capability inventory: The skill has the capability to write and update script records in the ServiceNow database using SN-Create-Record and SN-Update-Record.
- Sanitization: The skill does not provide specific instructions for sanitizing user-provided logic before code generation.
Audit Metadata