navan-hello-world
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from the external Navan API, which represents an indirect prompt injection surface.
- Ingestion points: Trip and booking data is fetched from the Navan REST API in
SKILL.md(Steps 2, 3, and 4). - Boundary markers: The instructions do not define specific delimiters or instructions to ignore potential commands within the data retrieved from the API.
- Capability inventory: The skill has access to
Write,Edit, andBashtools, which could theoretically be abused if malicious instructions were returned by the API and followed by the agent. - Sanitization: The provided code examples demonstrate parsing specific JSON fields (e.g.,
uuid,traveler_name), which acts as structural validation. - [DYNAMIC_EXECUTION]: A shell example in the documentation uses an inline Python script for data processing.
- Evidence:
SKILL.mdcontains acurlpipeline that pipes output topython3 -c "import sys,json; print(json.load(sys.stdin)['access_token'])". - Context: This is a benign use of runtime execution for JSON parsing using a static, visible script template.
Audit Metadata