navan-core-workflow-a
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from an external source (Navan API), which could theoretically contain malicious instructions targeting the agent.\n
- Ingestion points: The logic in
SKILL.mdfetches booking data from thehttps://api.navan.com/v1/bookingsendpoint.\n - Boundary markers: No specific boundary markers or instructions to ignore embedded commands are included in the provided code snippets.\n
- Capability inventory: The skill is restricted to network reads and console logging; it does not invoke file writing, subprocess execution, or other high-privilege tools.\n
- Sanitization: External data from the API is directly output to the console without sanitization or validation.
Audit Metadata