skills/vm0-ai/vm0-skills/servicenow/Gen Agent Trust Hub

servicenow

Pass

Audited by Gen Agent Trust Hub on Jun 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses curl and jq within several documented examples to perform operations like fetching incidents, updating records, and parsing JSON responses.
  • [EXTERNAL_DOWNLOADS]: The skill makes network requests to *.service-now.com to interact with ServiceNow's REST API. ServiceNow is a well-known enterprise service provider.
  • [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection (Category 8).
  • Ingestion points: Data is ingested from external ServiceNow tables including incident, change_request, sys_user, and cmdb_ci via curl commands.
  • Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the provided command examples.
  • Capability inventory: The skill utilizes curl for network and file operations (e.g., -d @/tmp/servicenow_request.json) and jq for data processing.
  • Sanitization: No explicit sanitization or filtering of the content retrieved from ServiceNow is demonstrated before it is presumably processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 14, 2026, 01:52 AM
Security Audit — agent-trust-hub — servicenow