重要前提
安装AI Skills的关键前提是:必须科学上网,且开启TUN模式,这一点至关重要,直接决定安装能否顺利完成,在此郑重提醒三遍:科学上网,科学上网,科学上网。查看完整安装教程 →
npx skills add https://github.com/groeimetai/snow-flow --skill code-review在审查 ServiceNow 服务器端代码(业务规则、脚本包含、计划作业等)时,请使用此清单。
// CHECK FOR THESE ES6+ VIOLATIONS:
const x = 5; // ❌ Use var
let items = []; // ❌ Use var
() => {} // ❌ Use function()
`template ${var}` // ❌ Use 'string ' + var
for (x of arr) // ❌ Use traditional for loop
{a, b} = obj // ❌ Use obj.a, obj.b
操作: 将所有 ES6+ 语法标记为关键错误。
// ❌ DANGEROUS - User input directly in query
gr.addEncodedQuery(userInput)
gr.addQuery("field", userInput) // OK if validated
// ✅ SAFE - Validate and sanitize
var safeInput = new GlideSysAttachment().cleanFileName(userInput)
gr.addQuery("field", safeInput)
// ❌ DANGEROUS - Unescaped output
gs.addInfoMessage(userInput)
// ✅ SAFE - Escape HTML
gs.addInfoMessage(GlideStringUtil.escapeHTML(userInput))
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
// ❌ MISSING - No ACL check
var gr = new GlideRecord("sys_user")
gr.get(userProvidedSysId)
// ✅ SAFE - Check permissions
var gr = new GlideRecord("sys_user")
if (gr.get(userProvidedSysId) && gr.canRead()) {
// Process record
}
// ❌ DANGEROUS - Logging sensitive data
gs.info("Password: " + password)
gs.info("API Key: " + apiKey)
// ✅ SAFE - Never log credentials
gs.info("Authentication attempt for user: " + username)
// ❌ SLOW - N+1 query problem
for (var i = 0; i < userIds.length; i++) {
var gr = new GlideRecord("sys_user")
gr.get(userIds[i]) // Query for each user!
}
// ✅ FAST - Single query
var gr = new GlideRecord("sys_user")
gr.addQuery("sys_id", "IN", userIds.join(","))
gr.query()
while (gr.next()) {}
// ❌ SLOW - Could return millions of records
var gr = new GlideRecord("incident")
gr.query()
// ✅ FAST - Limit results
var gr = new GlideRecord("incident")
gr.setLimit(1000)
gr.query()
// ❌ WASTEFUL - Query just to check existence
var gr = new GlideRecord("incident")
gr.addQuery("number", incNumber)
gr.query()
if (gr.getRowCount() > 0) {
}
// ✅ EFFICIENT - Use get() for single record
var gr = new GlideRecord("incident")
if (gr.get("number", incNumber)) {
}
// ❌ SLOW - Counting with loop
var count = 0
var gr = new GlideRecord("incident")
gr.addQuery("active", true)
gr.query()
while (gr.next()) count++
// ✅ FAST - Use GlideAggregate
var ga = new GlideAggregate("incident")
ga.addQuery("active", true)
ga.addAggregate("COUNT")
ga.query()
var count = ga.next() ? ga.getAggregate("COUNT") : 0
// ❌ BAD - Hard-coded sys_id (breaks across instances)
var assignmentGroup = "681ccaf9c0a8016400b98a06818d57c7"
// ✅ GOOD - Use property or lookup
var assignmentGroup = gs.getProperty("my.default.assignment.group")
// OR
var gr = new GlideRecord("sys_user_group")
if (gr.get("name", "Service Desk")) {
var assignmentGroup = gr.getUniqueValue()
}
// ❌ BAD - Magic numbers
if (current.state == 6) {
}
if (current.priority == 1) {
}
// ✅ GOOD - Named constants or comments
var STATE_RESOLVED = 6
var PRIORITY_CRITICAL = 1
if (current.state == STATE_RESOLVED) {
}
// ❌ BAD - No error handling
var response = request.execute()
var data = JSON.parse(response.getBody())
// ✅ GOOD - Proper error handling
try {
var response = request.execute()
var status = response.getStatusCode()
if (status != 200) {
gs.error("API call failed: " + status)
return null
}
var data = JSON.parse(response.getBody())
} catch (e) {
gs.error("Exception: " + e.message)
return null
}
// ❌ BAD - No context in logs
gs.info("Error occurred")
// ✅ GOOD - Contextual logging
gs.info("[MyScriptInclude.process] Processing incident: " + current.number + ", user: " + gs.getUserName())
// ❌ DANGEROUS - Can cause infinite loop
current.update() // In a Before rule
// ✅ SAFE - Use workflow control
current.setWorkflow(false)
current.update()
current.setWorkflow(true)
// ❌ WRONG - Heavy processing in Before rule
// Before rules should be fast!
// ✅ RIGHT - Use Async for heavy operations
// Move integrations and heavy processing to Async rules
审查代码时,请按以下结构组织反馈:
## Code Review Summary
### Critical Issues (Must Fix)
1. [SECURITY] Description...
2. [ES5] Description...
### Performance Issues (Should Fix)
1. [PERF] Description...
### Code Quality (Nice to Have)
1. [QUALITY] Description...
### Positive Observations
- Good use of...
- Well-structured...
| 级别 | 操作 | 示例 |
|---|---|---|
| 关键 | 部署前必须修复 | 安全漏洞,ES6 语法 |
| 高 | 应该修复 | 性能问题,缺少错误处理 |
| 中 | 建议修复 | 代码质量,硬编码值 |
| 低 | 考虑修复 | 风格,小的改进 |
每周安装数
51
代码仓库
GitHub 星标数
58
首次出现
2026年1月22日
安全审计
安装在
claude-code47
opencode45
gemini-cli45
github-copilot45
codex45
cursor44
Use this checklist when reviewing ServiceNow server-side code (Business Rules, Script Includes, Scheduled Jobs, etc.).
// CHECK FOR THESE ES6+ VIOLATIONS:
const x = 5; // ❌ Use var
let items = []; // ❌ Use var
() => {} // ❌ Use function()
`template ${var}` // ❌ Use 'string ' + var
for (x of arr) // ❌ Use traditional for loop
{a, b} = obj // ❌ Use obj.a, obj.b
Action: Flag ALL ES6+ syntax as CRITICAL errors.
// ❌ DANGEROUS - User input directly in query
gr.addEncodedQuery(userInput)
gr.addQuery("field", userInput) // OK if validated
// ✅ SAFE - Validate and sanitize
var safeInput = new GlideSysAttachment().cleanFileName(userInput)
gr.addQuery("field", safeInput)
// ❌ DANGEROUS - Unescaped output
gs.addInfoMessage(userInput)
// ✅ SAFE - Escape HTML
gs.addInfoMessage(GlideStringUtil.escapeHTML(userInput))
// ❌ MISSING - No ACL check
var gr = new GlideRecord("sys_user")
gr.get(userProvidedSysId)
// ✅ SAFE - Check permissions
var gr = new GlideRecord("sys_user")
if (gr.get(userProvidedSysId) && gr.canRead()) {
// Process record
}
// ❌ DANGEROUS - Logging sensitive data
gs.info("Password: " + password)
gs.info("API Key: " + apiKey)
// ✅ SAFE - Never log credentials
gs.info("Authentication attempt for user: " + username)
// ❌ SLOW - N+1 query problem
for (var i = 0; i < userIds.length; i++) {
var gr = new GlideRecord("sys_user")
gr.get(userIds[i]) // Query for each user!
}
// ✅ FAST - Single query
var gr = new GlideRecord("sys_user")
gr.addQuery("sys_id", "IN", userIds.join(","))
gr.query()
while (gr.next()) {}
// ❌ SLOW - Could return millions of records
var gr = new GlideRecord("incident")
gr.query()
// ✅ FAST - Limit results
var gr = new GlideRecord("incident")
gr.setLimit(1000)
gr.query()
// ❌ WASTEFUL - Query just to check existence
var gr = new GlideRecord("incident")
gr.addQuery("number", incNumber)
gr.query()
if (gr.getRowCount() > 0) {
}
// ✅ EFFICIENT - Use get() for single record
var gr = new GlideRecord("incident")
if (gr.get("number", incNumber)) {
}
// ❌ SLOW - Counting with loop
var count = 0
var gr = new GlideRecord("incident")
gr.addQuery("active", true)
gr.query()
while (gr.next()) count++
// ✅ FAST - Use GlideAggregate
var ga = new GlideAggregate("incident")
ga.addQuery("active", true)
ga.addAggregate("COUNT")
ga.query()
var count = ga.next() ? ga.getAggregate("COUNT") : 0
// ❌ BAD - Hard-coded sys_id (breaks across instances)
var assignmentGroup = "681ccaf9c0a8016400b98a06818d57c7"
// ✅ GOOD - Use property or lookup
var assignmentGroup = gs.getProperty("my.default.assignment.group")
// OR
var gr = new GlideRecord("sys_user_group")
if (gr.get("name", "Service Desk")) {
var assignmentGroup = gr.getUniqueValue()
}
// ❌ BAD - Magic numbers
if (current.state == 6) {
}
if (current.priority == 1) {
}
// ✅ GOOD - Named constants or comments
var STATE_RESOLVED = 6
var PRIORITY_CRITICAL = 1
if (current.state == STATE_RESOLVED) {
}
// ❌ BAD - No error handling
var response = request.execute()
var data = JSON.parse(response.getBody())
// ✅ GOOD - Proper error handling
try {
var response = request.execute()
var status = response.getStatusCode()
if (status != 200) {
gs.error("API call failed: " + status)
return null
}
var data = JSON.parse(response.getBody())
} catch (e) {
gs.error("Exception: " + e.message)
return null
}
// ❌ BAD - No context in logs
gs.info("Error occurred")
// ✅ GOOD - Contextual logging
gs.info("[MyScriptInclude.process] Processing incident: " + current.number + ", user: " + gs.getUserName())
// ❌ DANGEROUS - Can cause infinite loop
current.update() // In a Before rule
// ✅ SAFE - Use workflow control
current.setWorkflow(false)
current.update()
current.setWorkflow(true)
// ❌ WRONG - Heavy processing in Before rule
// Before rules should be fast!
// ✅ RIGHT - Use Async for heavy operations
// Move integrations and heavy processing to Async rules
When reviewing code, structure your feedback as:
## Code Review Summary
### Critical Issues (Must Fix)
1. [SECURITY] Description...
2. [ES5] Description...
### Performance Issues (Should Fix)
1. [PERF] Description...
### Code Quality (Nice to Have)
1. [QUALITY] Description...
### Positive Observations
- Good use of...
- Well-structured...
| Level | Action | Examples |
|---|---|---|
| CRITICAL | Must fix before deployment | Security vulnerabilities, ES6 syntax |
| HIGH | Should fix | Performance issues, missing error handling |
| MEDIUM | Recommend fixing | Code quality, hard-coded values |
| LOW | Consider fixing | Style, minor improvements |
Weekly Installs
51
Repository
GitHub Stars
58
First Seen
Jan 22, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykPass
Installed on
claude-code47
opencode45
gemini-cli45
github-copilot45
codex45
cursor44
Lark Mail CLI 使用指南:邮件管理、安全规则与自动化工作流
47,900 周安装