servicenow
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill follows standard security practices by instructing users to store credentials in environment variables rather than hardcoding them.
- [SAFE]: All external references and network endpoints (unify.apideck.com, developers.apideck.com) belong to the official vendor infrastructure for Apideck and ServiceNow.
- [INDIRECT_PROMPT_INJECTION]: The skill provides a surface for processing external data through the Proxy API. This is a characteristic of the tool's intended purpose rather than a vulnerability.
- Ingestion points: The agent receives target endpoints and data payloads from user instructions to be used as
x-apideck-downstream-urland request bodies inSKILL.md. - Boundary markers: No specific delimiters are provided for the content being forwarded.
- Capability inventory: The skill enables network operations via HTTP requests to the Apideck Proxy endpoint.
- Sanitization: No explicit sanitization of the downstream URL or payload is performed, as the proxy is designed to forward raw ServiceNow-compatible data.
Audit Metadata