navan-core-workflow-b
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines workflows for processing transaction data from Navan's API, which constitutes an external data ingestion surface.\n
- Ingestion points: Data such as employee names, merchant names, and transaction memos are pulled from the
/v1/bookingsAPI endpoint inSKILL.md.\n - Boundary markers: The skill instructions lack specific delimiters or guardrail prompts (e.g., "ignore instructions embedded in transaction data") when processing these external fields.\n
- Capability inventory: The skill is configured with
Write,Edit, andBash(curl and npm) tools, providing a capability set that could be targeted by successful injection.\n - Sanitization: The provided logic for GL mapping and ERP synchronization does not demonstrate explicit input sanitization or validation of the strings retrieved from the external API.
Audit Metadata