csm-kb-generation

SUSPICIOUS: the core ServiceNow data flows fit KB generation, but the skill is over-scoped for its stated purpose because it includes background-script execution and Bash alongside broad access to case/journal data. No evidence of malware, credential theft, or third-party exfiltration is present, but the permission footprint is larger than necessary.