ServiceNow Agent

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:19 AM UTC
• Version: 0.1.1

Overview

The skill appears intended to provide read-only ServiceNow access, but its bundled API references include write and delete operations that do not fit the read-only framing.

Review this before installing in production. Use a dedicated read-only ServiceNow account, avoid admin credentials, treat downloaded attachments and ticket histories as sensitive, and do not let agents use the bundled OpenAPI references for POST, PUT, PATCH, or DELETE operations unless you intentionally want a write-capable integration.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (19)

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill is explicitly described as read-only, but this OpenAPI spec includes POST upload endpoints and a DELETE attachment endpoint that enable modification and destruction of data. In an agent setting, this mismatch is dangerous because downstream tooling or an LLM may invoke these operations under the false assumption that the skill cannot change state.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The API description states that it allows upload, download, and removal of attachments, directly contradicting the skill metadata that says the skill is read-only. This creates a trust-boundary problem: users and orchestration layers may permit the skill in sensitive contexts because they believe it cannot alter records, when in fact the reference advertises write and delete capability.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The OpenAPI spec clearly exposes numerous state-changing and destructive operations (POST, PUT, DELETE), including order submission, cart mutation, item deletion, and resource deletion, while the skill metadata claims the capability is read-only. This mismatch is dangerous because downstream agents, users, or policy systems may trust the read-only description and authorize use under false assumptions, enabling unintended remote modifications.

Scope Creep

High

• Confidence: 99% confidence
• Finding: The declared read-only scope is exceeded throughout the API definition by endpoints that can create, update, submit, duplicate, and delete ServiceNow resources. In an agent setting, this is especially risky because policy engines may grant the skill broad use based on the read-only label, creating a privilege/expectation gap that can lead to unauthorized changes or purchases.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill is explicitly described as read-only, but this OpenAPI reference advertises create, update, and delete capabilities. That mismatch can cause an agent, integrator, or downstream tooling to invoke mutating operations under the false assumption that the skill is safe for read-only use, leading to unauthorized record changes or deletion in ServiceNow.

Scope Creep

High

• Confidence: 99% confidence
• Finding: The operations defined in this range include record creation, modification, and deletion, which exceed the declared read-only scope of the skill. In an agent setting, such scope drift is dangerous because policy engines or users may trust the metadata while the actual callable surface still permits state-changing actions against enterprise ITSM data.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The description states the API allows CRUD operations, directly contradicting the skill's documented read-only purpose. This inconsistency increases the risk of unsafe deployment decisions, mistaken trust by users, and accidental enablement of write behavior through tooling that consumes the spec verbatim.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs operators to store and use ServiceNow username/password credentials in a local .env file, but it provides no warning about secret handling, credential scope, or avoiding exposure in logs and shell history. While credential use is expected for this integration, the lack of privacy/safety guidance increases the chance of accidental disclosure or insecure handling of privileged enterprise access.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill supports downloading ServiceNow attachment contents directly to local files, but it does not warn that attachments may contain sensitive business data, credentials, customer information, or malware. This can lead to unnecessary replication of sensitive data onto local disks and unsafe handling of untrusted files.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The history feature explicitly retrieves full ticket conversations, comments, and work notes, which commonly contain PII, incident details, internal operational context, and sometimes secrets entered by users. Without a privacy warning or data-minimization guidance, the skill normalizes broad access to sensitive conversational history.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The spec introduces attachment upload capability without any warning that the operation changes system state or may place untrusted content into ServiceNow records. In the context of a supposedly read-only agent skill, the absence of a warning materially increases the chance of accidental misuse or prompt-induced state changes.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The DELETE endpoint removes attachments, but the spec provides no warning that the action is destructive and potentially irreversible. In an agent environment, missing destructive-operation labeling can lead to unintended data loss, especially when the enclosing skill is represented as read-only and therefore perceived as safe to use autonomously.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The cart item deletion endpoint performs a destructive action but the spec provides no warning, confirmation semantics, or user-facing disclosure. In the context of a supposedly read-only skill, this omission increases the chance that an agent could remove items unexpectedly, causing workflow disruption or loss of prepared orders.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The cart emptying endpoint can wipe an entire cart, yet the spec contains no warning or indication that it is a destructive bulk action. Because the skill is advertised as read-only, an operator or agent may invoke it without realizing it can remove all pending selections, potentially causing significant business disruption or forced rework.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The item deletion endpoint allows removal of a catalog-related record without any warning or safety disclosure in the API spec. Lack of signaling around destructive behavior raises the risk of accidental or automated deletion, particularly when users expect only inspection capabilities from this skill.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The order_now endpoint can immediately place an order, but the spec does not disclose that this has real-world side effects or may trigger provisioning, purchases, or fulfillment workflows. In a read-only-labeled skill, this creates a high risk of unauthorized or accidental order placement by an agent acting on misleading capability information.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The delete_resource endpoint removes resources but offers no warning, action description, or indication of permanence. This makes accidental destructive use more likely and undermines safe-tooling expectations, especially in an agent ecosystem where manifests are relied on for operational safety.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The service fulfillment step deletion endpoint can delete workflow/configuration steps without any safety disclosure in the spec. This can disrupt fulfillment processes or corrupt configuration state if an agent invokes it under the mistaken assumption that the skill is limited to observation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Documenting destructive CRUD capabilities without clear warnings obscures the operational risk of modifying or deleting production ServiceNow records. In this skill context, the absence of warnings is more dangerous because the surrounding metadata primes users to believe the integration is read-only, reducing caution around potentially destructive actions.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: cli.mjs:149