I'm sure you read this already, but take another look at the definition of the Sails services. This, basically, means that you can have in your services any common code, not necessarily something dealing with request and response. For example, there can be a part of your application that you are running from the command line: there will be no request or response in this case, but you still want to be able to use your services.
Bottom line, you are doing it right already by passing req/res. (Just don't overdo it: you should only create services for the code you are using in multiple places, doing it for every controller doesn't make sense).