skill-feedback

The server leverages Python scripts for ServiceNow API interaction and browser automation (Selenium) for authentication. Input parameters for the Python script are validated using Zod, mitigating command injection risks. Credentials are managed via a session manager that stores them in a local file (`~/.servicenow_surf_session.json`) or environment variables, and supports auto-refresh on 401 errors. Browser automation for login requires user interaction and may involve `execute_script` to extract tokens from the authenticated ServiceNow page; this is a controlled use case targeting a trusted domain. While credentials are printed to console during initial setup, this is a standard practice for environment variable instructions. No direct 'eval' or execution of arbitrary user-controlled code is observed.