navan-incident-runbook
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill documents standard operational procedures for incident response related to the Navan travel platform, including booking failures and API outages.
- [COMMAND_EXECUTION]: Includes Bash scripts for testing API health and OAuth authentication. These scripts use standard tools (
curl,jq) and target legitimate Navan endpoints (api.navan.com). - [CREDENTIALS_UNSAFE]: The skill correctly handles sensitive data by instructing the user to store credentials in a secret manager and accessing them via environment variables (
$NAVAN_CLIENT_ID,$NAVAN_CLIENT_SECRET) rather than hardcoding them. - [DATA_EXFILTRATION]: No evidence of unauthorized data exfiltration. Network requests are limited to official Navan domains for the purpose of service status verification and authentication.
- [PROMPT_INJECTION]: No malicious injection patterns or instruction overrides were detected in the skill instructions or metadata.
Audit Metadata