fluent-brownfield-migration

Pass

Audited by Gen Agent Trust Hub on Sep 6, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of application metadata and script content from ServiceNow instances for conversion and modernization.
  • Ingestion points: Application records and XML metadata are pulled from remote ServiceNow instances using the snow_fluent_init and snow_fluent_download tools (SKILL.md).
  • Boundary markers: The instructions do not define clear delimiters or provide the agent with specific directions to ignore or sanitize embedded instructions within the ingested metadata records.
  • Capability inventory: The skill possesses the capability to execute local build tools (snow_fluent_build), network-connected download tools (snow_fluent_download), and instance-modifying deployment tools (snow_fluent_install) (SKILL.md).
  • Sanitization: No evidence of content sanitization or integrity validation is described for the records retrieved from external instances before they are processed by the agent.
  • [COMMAND_EXECUTION]: The skill instructs the agent to use various CLI tools to manage the application lifecycle.
  • Evidence: The workflow involves running now-sdk CLI commands (init, transform, build, install, download, dependencies) via the snow_fluent_* tools. While these operate within the local developer environment and target identified instances, they involve execution of external binaries and file system modifications consistent with the skill's purpose.
  • [EXTERNAL_DOWNLOADS]: The skill references and utilizes the official ServiceNow SDK and associated CLI tools.
  • Evidence: The skill documentation specifies a dependency on the @servicenow/sdk (version 4.x) and the now-sdk CLI. It facilitates downloading application configuration and metadata from ServiceNow instances during the synchronization phase (SKILL.md). These references target a well-known service provider and are documented as standard operations for the migration process.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 6, 2026, 07:16 PM
Security Audit — agent-trust-hub — fluent-brownfield-migration