scripted-rest-apis
Pass
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill leverages ServiceNow management tools like
SN-Execute-Background-ScriptandSN-Create-Recordto facilitate server-side script deployment and database operations. These tools are used in alignment with their intended administrative purposes. - [INDIRECT_PROMPT_INJECTION]: The skill documents the creation of API endpoints that process untrusted data from external requests (body, query parameters, and path parameters). While the provided examples include validation patterns such as regex for email and type checks for limits, the resulting APIs represent a standard entry point for external data that developers must carefully sanitize.
- [DATA_EXPOSURE]: Code examples demonstrate the handling of sensitive integration data, such as API keys and authentication headers. The skill follows security best practices by recommending dynamic validation and retrieval of secrets rather than hardcoding credentials.
Audit Metadata