navan-data-sync
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill demonstrates secure coding practices by handling sensitive API credentials through environment variables rather than hardcoding them. It also includes instructions for verifying webhook signatures to ensure data authenticity.
- [INDIRECT_PROMPT_INJECTION]: The skill establishes an interface for ingesting data from external APIs and webhooks, which constitutes an injection surface. Ingestion points: Navan REST API endpoints and a custom Node.js webhook listener. Boundary markers: None identified in the code snippets. Capability inventory: network requests (fetch, requests), file writing (fs.writeFileSync), and local server hosting. Sanitization: The examples process JSON data without explicit validation or filtering of specific fields.
Audit Metadata