fluent-brownfield-migration
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of application metadata and script content from ServiceNow instances for conversion and modernization.
- Ingestion points: Application records and XML metadata are pulled from remote ServiceNow instances using the
snow_fluent_initandsnow_fluent_downloadtools (SKILL.md). - Boundary markers: The instructions do not define clear delimiters or provide the agent with specific directions to ignore or sanitize embedded instructions within the ingested metadata records.
- Capability inventory: The skill possesses the capability to execute local build tools (
snow_fluent_build), network-connected download tools (snow_fluent_download), and instance-modifying deployment tools (snow_fluent_install) (SKILL.md). - Sanitization: No evidence of content sanitization or integrity validation is described for the records retrieved from external instances before they are processed by the agent.
- [COMMAND_EXECUTION]: The skill instructs the agent to use various CLI tools to manage the application lifecycle.
- Evidence: The workflow involves running
now-sdkCLI commands (init, transform, build, install, download, dependencies) via thesnow_fluent_*tools. While these operate within the local developer environment and target identified instances, they involve execution of external binaries and file system modifications consistent with the skill's purpose. - [EXTERNAL_DOWNLOADS]: The skill references and utilizes the official ServiceNow SDK and associated CLI tools.
- Evidence: The skill documentation specifies a dependency on the
@servicenow/sdk(version 4.x) and thenow-sdkCLI. It facilitates downloading application configuration and metadata from ServiceNow instances during the synchronization phase (SKILL.md). These references target a well-known service provider and are documented as standard operations for the migration process.
Audit Metadata