microsoft/servicenow-change-management
labs/zava-learning/sre-config/agent-config/skills/servicenow-change-management/SKILL.md
Use whenever a Zava Learning investigation produces a durable fix that needs change management — after a GitHub PR is opened for an Infrastructure-as-Code or application code root cause, raise a ServiceNow Change Request referencing the PR and attach the RCA report. The single owner of ServiceNow Change Request and attachment operations.
$ install --global
skillsauthnpx skillsauth add microsoft/sre-agent servicenow-change-managementInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 23, 2026, 7:53 AM90.4s1 file scanned
SKILL.md
- api_version:
- azuresre.ai/v2
- kind:
- Skill
- name:
- servicenow-change-management
- description:
- Use whenever a Zava Learning investigation produces a durable fix that needs change management — after a GitHub PR is opened for an Infrastructure-as-Code or application code root cause, raise a ServiceNow Change Request referencing the PR and attach the RCA report. The single owner of ServiceNow Change Request and attachment operations.
Zava Learning — ServiceNow Change Management
Use this skill to record a durable remediation in ServiceNow once the root cause is fixed in code or
IaC. It is the single owner of ServiceNow Change Request and attachment operations, and applies
after a GitHub PR has been opened (by pr-delivery) for the durable fix.
When to use
- A connectivity/edge or application incident has been root-caused to an IaC (
infra/) or application (src/) change, and a GitHub PR has been opened with the fix. - An operator explicitly asks to open a Change Request or attach an RCA to an existing record.
Do not raise a Change Request for live mitigations alone (deleting an NSG rule, restarting/rolling back a revision) — those are tracked as PagerDuty incident notes. The Change Request tracks the durable code/IaC fix.
Steps
- Create the Change Request with
CreateServiceNowChangeRequest:short_description: one-line summary of the change (symptom + fix).description: the RCA summary including the GitHub PR URL.change_type:normal(default),standard, oremergencyfor active customer-impacting fixes.implementation_plan/riskas appropriate.- Capture the returned change
number(e.g.CHG0030042),sys_id, and the ready-to-use clickablelinkthe tool returns. Surface the CR in the Artifacts & links section as a markdown hyperlink[<number>](<link>)using that returnedlink— never the bare CHG number, which is not clickable. (Do not try to build the URL from aSERVICENOW_URLenv var — it is not available in the agent environment; the tool already returns the full clickablelink.)
- Attach the RCA with
UploadServiceNowAttachment:table_sys_id: the Change Requestsys_idfrom step 1.file_name: e.g.rca-<symptom>.md.content: the full RCA report (timeline, root cause, fix, verification).
- Reference the Change Request number back in the PagerDuty incident notes and the GitHub PR.
Notes
- Apply the
zava-redactionstandard to thedescription,implementation_plan, and the attached RCA before submitting — mask any secret, token, connection string, or learner PII as[REDACTED:<CLASS>]. The Change Request and its attachment are operator-visible records. - Credentials (
SERVICENOW_URL/USER/PASS) are injected from the agent environment (Key Vault-backed); never request or hardcode them. - If ServiceNow credentials are not configured, the tools return
success: false— report that the Change Request could not be created and continue the incident lifecycle in PagerDuty.
Related Skills
microsoft/zava-reporting
development
VerifiedTrustedCommunity
Use to package a completed Zava Learning incident analysis for the audience. First present a branded in-thread executive summary (markdown with the before/after visuals inline), then produce the downloadable deliverables — a PowerPoint deck, an HTML email, and a Teams notification — using the Zava corporate template. The calling agent may narrow this to a subset (e.g. only the HTML report). Produces content and artifacts; it does not send them. Assembles the output of rca-analysis, evidence-before-after, recommendations-next-steps, and pr-delivery.
123SKILL.mdUpdated Jun 23, 2026
microsoft/zava-audit-report
development
VerifiedTrustedCommunity
Use to package a completed Zava Learning weekly governance audit (NSG / network security, RBAC / least-privilege, or cloud cost) into a single branded, downloadable PowerPoint deck in the Zava house style. The calling audit agent passes its findings (a list of rows with severity) and a short posture summary; this skill renders the deck, applies redaction, and returns the attachment download link. Produces the artifact; it does not send it.
123SKILL.mdUpdated Jun 23, 2026
microsoft/redaction-guard
development
VerifiedTrustedCommunity
Use whenever you are about to emit operator-visible content — a chat/thread message, a PagerDuty or ServiceNow note, a commit message or pull-request body, or any report artifact (HTML, PowerPoint, Teams card). Deterministically masks secrets, credentials, tokens, private keys, URI-embedded passwords, and PII so they never appear in the thread or in any deliverable. This is a cross-cutting guardrail invoked by the output-producing skills, not a runbook step.
123SKILL.mdUpdated Jun 23, 2026
microsoft/recommendations-next-steps
testing
VerifiedTrustedCommunity
Use to produce the forward-looking recommendations and next steps for a Zava Learning incident — prioritized preventive, detective, and process actions with owners, target dates, and the risk of inaction. Its output is used in the zava-reporting deliverables.
123SKILL.mdUpdated Jun 23, 2026