Navil Policy

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:21 AM UTC
• Version: 1.0.2

Overview

This skill is coherent overall, but it needs Review because its artifact checksums do not match and its install guidance uses an unpinned pip package with a system-package protection bypass.

Review this skill before installing. Prefer installing Navil in an isolated environment such as pipx or a virtual environment, using a pinned and verified version. Check the publisher/package provenance, do not rely on the mismatched bundled checksums, and carefully review any `~/.navil/policy*.yaml` files before letting them affect future agent tool access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:49

Finding

Unpinned Third-Party Package Installation with System Package Protection Bypass

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–18 and 49–55
Vulnerability Type: Unpinned and insufficiently verified third-party dependency installation
Risk Level: Medium

Vulnerable Code

Lines 12–18:

yaml

requires:
  bins:
    - pip
install:
  - id: pip-navil
    kind: pip
    package: navil
    bins: [navil]

Lines 49–55:

bash

navil --version

If navil is not installed, install it first:

bash

pip install navil --break-system-packages 2>/dev/null || pip install navil

Technical Analysis

The skill directs users to install the navil package from PyPI without specifying an exact version or cryptographic integrity hash. Consequently, the installed artifact and its transitive dependencies are determined dynamically at installation time and may differ from those reviewed when the skill was published.

Python packages can execute installation or build-related code, and their installed modules execute with the privileges of the user running them. If the package publisher, distribution account, package artifact, or a transitive dependency is compromised, following this instruction could cause attacker-controlled code to execute locally.

The --break-system-packages option bypasses protections intended to prevent pip from modifying an externally managed Python environment. This increases the possibility of dependency conflicts and system Python corruption. Redirecting standard error to /dev/null also hides diagnostics from the first installation attempt, reducing the user's ability to identify package-resolution, integrity, or environment-management problems.

The project metadata references a GitHub repository, but the installation command does not cryptographically establish that the retrieved PyPI artifact corresponds to reviewed source from that repository.

Attack Path

1. An attacker compromises the PyPI publisher account, an upstream dependency, or a subsequently published package release. 2 ...[truncated 1393 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an audited exact version, for example navil==X.Y.Z, after verifying that release.
2. Publish and verify cryptographic hashes for the package and all transitive dependencies, using a locked requirements file and pip install --require-hashes.
3. Install the command in an isolated environment with pipx or a dedicated virtual environment rather than modifying the system-managed Python installation.
4. Remove --break-system-packages from the recommended command. If system-wide installation is genuinely required, explain the risks and require explicit user approval.
5. Do not suppress standard error with 2>/dev/null; preserve installation diagnostics so users can detect failures and suspicious package-resolution behavior.
6. Bind reviewed source to distributed artifacts through signed releases, provenance attestations, or documented package hashes.
7. Verify and document that the PyPI package publisher and release artifact correspond to the repository identified in skill.json and the SKILL.md metadata.
8. Regularly audit and lock transitive dependencies to reduce exposure to compromised or unexpectedly changed upstream packages.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill metadata and frontmatter include many broad, overlapping trigger phrases such as token costs, context window bloat, tool scoping, permissions, and cost savings. This can cause the skill to activate in situations where the user did not specifically ask to modify MCP policy, increasing the chance of unnecessary package installation suggestions and policy-changing guidance being surfaced in unrelated contexts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 74% confidence

Finding

The skill instructs users to create and persist policy files under ~/.navil, including auto-generated policy baselines and manual overrides. Persisting agent-observed tool usage and durable access-control state can create long-lived configuration artifacts that outlast the current session, potentially exposing workflow patterns or leaving overly permissive rules like allow: "*" in place if not carefully reviewed.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

This creates `~/.navil/policy.auto.yaml` based on observed baselines. Review it, then copy rules you want to keep into `~/.navil/policy.yaml`.

### Step 4: Write Custom Policy

For manual policy creation, create `~/.navil/policy.yaml`:

Static analysis

No suspicious patterns detected.