catalog-items
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a reference guide for ServiceNow Service Catalog development. The code examples demonstrate standard practices for creating catalog items, variables, client scripts, and workflows within the ServiceNow ecosystem.
- [COMMAND_EXECUTION]: The skill uses ServiceNow-specific tools (
snow_create_catalog_item,snow_query_table, etc.) to interact with the ServiceNow API. These are platform-specific tools for environment management and do not involve arbitrary shell command execution. - [DATA_EXPOSURE_&_EXFILTRATION]: While the skill interacts with ServiceNow data tables (e.g.,
cmdb_model,sys_user), it does so through the intended platform mechanisms. There are no network operations targeting external or untrusted domains. - [INDIRECT_PROMPT_INJECTION]: The skill demonstrates how to handle user input via catalog variables and client scripts. While this introduces a standard web application attack surface (e.g., script injection within the ServiceNow portal), the skill provides examples of validation logic (
onSubmitscripts) and follows standard platform security patterns.
Audit Metadata