The Agent Skills Directory

[SAFE]: The skill's logic and tool usage are strictly aligned with its stated purpose of vulnerability management and data hygiene within the ServiceNow platform. No suspicious behaviors such as credential harvesting or unauthorized network access were observed.
[COMMAND_EXECUTION]: The skill uses the SN-Execute-Background-Script tool to run administrative JavaScript code for aggregate data analysis. These scripts are statically defined in the documentation and focus on identifying duplicate records and generating reports.
[PROMPT_INJECTION]: The skill was evaluated for indirect prompt injection surfaces (Category 8) as it processes data from external vulnerability scanners:
Ingestion points: Data is read from the sn_vul_vulnerable_item and sn_vul_entry tables in ServiceNow (SKILL.md).
Boundary markers: The skill does not employ specific delimiters when handling the imported vulnerability data.
Capability inventory: Access to SN-Execute-Background-Script, SN-Update-Record, and Bash tools is requested.
Sanitization: The skill relies on standard ServiceNow platform protections and does not include custom sanitization logic.
Risk Assessment: Because the ingestion of this data is fundamental to the skill's primary purpose and the scripts are non-executable on the data itself, the surface does not represent a security finding.

vulnerability-deduplication