Install
$ agentstack add skill-aatrey882-servicenow-agent-skills-sn-scripting ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
ServiceNow Legacy Scripting
ServiceNow legacy scripting uses the GlideRecord API for server-side data access, Script Include classes for reusable server-side logic, Business Rules for server-side automation, and gform/guser/g_list for client-side form manipulation. All APIs are described in the reference files below.
References
Read these files when you need them — do not pre-load all references at session start. Paths are relative to the skill root (the directory containing this SKILL.md file).
| File | When to Read | |------|-------------| | references/gliderecord.md | Generating or reviewing GlideRecord queries, CRUD operations, or addQuery/getValue patterns | | references/server-side.md | Generating Script Includes, Business Rules, or using GlideSystem (gs.*) logging | | references/client-side.md | Generating Client Scripts using gform, guser, or g_list; or any client-side form manipulation | | references/gotchas.md | Before generating or reviewing any ServiceNow script — check for hallucination traps |
Scripts
| Script | When to use | |--------|------------| | scripts/validate-script.sh | When validating a ServiceNow script file for common issues before deploying |
Examples
Use these as structural templates — only read the example that matches your target type, do not pre-load all examples:
| File | Demonstrates | |------|-------------| | assets/examples/gliderecord-crud.js | Complete GlideRecord CREATE, READ (single and multi), UPDATE, DELETE with correct getValue() usage | | assets/examples/script-include-class.js | Script Include using Class.create() pattern with initialize(), utility methods, and type property | | assets/examples/client-script-gform.js | Client Script onLoad/onChange handlers using gform.getValue(), gform.setMandatory(), g_user.hasRole() |
Hard Rules
- Never use GlideRecord when ServiceNow Fluent SDK is present.
If the workspace contains now.config.json, .now.ts files, or imports from @servicenow/sdk/core, the developer is working in a Fluent SDK application. Stop and redirect: "I can see you're working in a Fluent SDK project. Use the sn-sdk-fluent skill to generate typed metadata definitions instead of GlideRecord scripts. GlideRecord is the legacy scripting API and does not work inside Fluent SDK .now.ts files."
- GlideRecord is server-side only — never generate GlideRecord in a Client Script. Use GlideAjax.
- Always call query() before next() — while(gr.next()) without gr.query() never executes.
- Use getValue() in loops — gr.fieldname returns a pointer; gr.getValue('fieldname') returns the string value.
- Only use documented API methods — do not invent methods like gr.getField(), gr.setQuery(), or gr.addOrder().
Behavior by Task Type
Generating
- Check for Fluent SDK signals first (Hard Rule 1) — if detected, redirect immediately; do not generate GlideRecord code.
- Identify the script context: server-side (Business Rule, Script Include) or client-side (Client Script).
- For server-side: read
references/gliderecord.mdfor CRUD patterns,references/server-side.mdfor Script Include structure and Business Rule context variables. - For client-side: read
references/client-side.mdfor gform/guser/g_list APIs. Never generate GlideRecord in a client script (Hard Rule 2). - Use example files in
assets/examples/as working templates.
Reviewing
- Check Hard Rules 3 and 4: query() before next(), getValue() in loops.
- Verify no GlideRecord in client-side code (Hard Rule 2).
- Verify no invented methods — compare against
references/gliderecord.mddocumented API (Hard Rule 5). - Run
scripts/validate-script.shto check for GlideRecord in client scripts, bare setAbortAction, and g_form misuse.
Explaining
- Route the developer to the relevant reference file for detailed method documentation.
- For Fluent SDK questions, redirect to the sn-sdk-fluent skill.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: aatrey882
- Source: aatrey882/servicenow-agent-skills
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.