Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add serac-labs/serac --skill discovery-patternsgit clone --depth 1 https://github.com/serac-labs/seracWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/serac-labs/serac/discovery-patterns)<a href="https://agentmods.dev/skills/serac-labs/serac/discovery-patterns"><img src="https://agentmods.dev/badge/skills/serac-labs/serac/discovery-patterns/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/serac-labs/serac/discovery-patterns"><img src="https://agentmods.dev/badge/skills/serac-labs/serac/discovery-patterns.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00040 | $0.02651 |
| Opus 5.5 | $0.00016 | $0.01060 |
| Sonnet 5.5 | $0.00008 | $0.00530 |
| Haiku 4.5 | $0.00004 | $0.00265 |
Grade A, and why
discovery-patterns scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 392 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Discovery Patterns for ServiceNow
Discovery automatically populates the CMDB by scanning networks and systems.
Discovery Architecture
Discovery Schedule
↓
MID Server
↓
Probes (collect data)
↓
Sensors (process data)
↓
Identification Rules (match/create CIs)
↓
CMDB Population
Key Tables
| Table | Purpose |
|---|---|
discovery_schedule |
Discovery schedules |
discovery_credentials |
Discovery credentials |
discovery_range |
IP ranges to scan |
cmdb_identification_rule |
CI identification |
ecc_agent |
MID Server records |
discovery_status |
Discovery run status |
Discovery Schedules (ES5)
Create Discovery Schedule
// Create discovery schedule (ES5 ONLY!)
var schedule = new GlideRecord("discovery_schedule")
schedule.initialize()
// Basic info
schedule.setValue("name", "Data Center Discovery")
schedule.setValue("description", "Weekly discovery of data center infrastructure")
// Type
schedule.setValue("discover", "IP") // IP, CI, Cloud Resources
// Schedule
schedule.setValue("run_type", "weekly")
schedule.setValue("run_dayofweek", "sunday")
schedule.setValue("run_time", "02:00:00")
// MID Server
schedule.setValue("mid_server", getMIDServerSysId("DataCenterMID"))
// Enable
schedule.setValue("active", true)
var scheduleSysId = schedule.insert()
// Add IP range
addDiscoveryRange(scheduleSysId, "10.0.0.0", "10.0.255.255", "Data Center Network")
Add Discovery Range
// Add IP range to discovery schedule (ES5 ONLY!)
function addDiscoveryRange(scheduleSysId, startIP, endIP, name) {
var range = new GlideRecord("discovery_range")
range.initialize()
range.setValue("schedule", scheduleSysId)
range.setValue("name", name)
range.setValue("type", "range")
range.setValue("range_start", startIP)
range.setValue("range_end", endIP)
range.setValue("active", true)
return range.insert()
}
// Add CIDR range
function addDiscoveryCIDR(scheduleSysId, cidr, name) {
var range = new GlideRecord("discovery_range")
range.initialize()
range.setValue("schedule", scheduleSysId)
range.setValue("name", name)
range.setValue("type", "cidr")
range.setValue("range", cidr) // e.g., '10.0.0.0/24'
range.setValue("active", true)
return range.insert()
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 392 lines · 40 tokens per session scan A 9bbd504f2eb8
discovery-patterns is a skill published in the GitHub repository serac-labs/serac (78 stars, last pushed yesterday), licensed Apache-2.0. It adds 40 tokens to every session and 2,651 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
tailscale
This skill should be used when managing Tailscale mesh VPN networks. Use when the user asks to "check tailscale status", "list tailscale devices", "ping a device", "send file via tailscale", "tailscale funnel", "tailscale serve", "create auth key", "check who's online", "tailscale exit node", "Magic DNS", or mentions…
sn-safe-write
Change ServiceNow data safely — plan first, apply only after review, verify, and know how to revert. Use whenever a create, update, upsert or delete on an instance is requested.
sn-discover
Map a ServiceNow instance into Markdown (version and counts, custom applications, per-scope tables and artefacts) with the server's own document generator. Use when asked to discover, survey, inventory or document an instance or its custom apps.
sn-uib
Review a ServiceNow UI Builder (UIB) experience or workspace page — its page map, what a change would touch, data broker security and page weight. Use when asked to explain, audit or assess a UI Builder page, workspace or experience before changing it.
sn-security
Review the security posture of a ServiceNow instance — the ACL scan, hardening properties and cross-scope access — or explain why one user can or cannot read, write, create or delete a table, record or field. Use for a security review, a hardening check, or a "why can't this user see / edit it" question.
sn-upgrade
Review ServiceNow upgrade readiness — the upgrade history, the skipped records an upgrade left unresolved, base vs customer versions of one skip, and store apps with an update. Use after a family or patch upgrade, before planning one, or when asked which skipped records to revert, keep or merge.