Servicenow Docs

Search and retrieve ServiceNow documentation, release notes, and developer docs (APIs, references, guides). Uses docs.servicenow.com via Zoomin and developer.servicenow.com APIs for developer topics.

This skill appears to do what it says: search and fetch ServiceNow docs via ServiceNow-hosted APIs and pages, and it does not ask for credentials or local file access. Before installing, consider: 1) the skill will make HTTP requests to servicenow-be-prod.servicenow.com and developer.servicenow.com — avoid sending sensitive or private data in queries you don't want transmitted; 2) the package includes a code file (logic.ts) bundled with the skill — if you require higher assurance, review the full source (the truncated portion in the provided listing should be inspected) or prefer a skill from a known publisher/homepage; 3) the skill may rely on public ServiceNow endpoints that could change or require authentication in some contexts, so expect occasional failures. If you are comfortable with those tradeoffs, the skill is internally consistent with its stated purpose.

Type: OpenClaw Skill Name: servicenow-docs Version: 1.1.0 The skill is classified as suspicious due to a Server-Side Request Forgery (SSRF) vulnerability in the `servicenow_get_article` tool. The `logic.ts` file's `getArticle` function performs a `fetch` request to an arbitrary URL provided in the `url` parameter without any domain validation. While the `SKILL.md` description for this tool misleadingly suggests the URL is 'automatically converted from Zoomin to docs.servicenow.com', the underlying code fetches the provided URL directly. This allows an attacker to potentially instruct the AI agent via prompt injection to fetch content from internal network resources or other arbitrary external endpoints, leading to information disclosure or other network-based attacks.