← Back to Skills Marketplace
Navil Audit
by
ivanpantheon
· GitHub ↗
· v1.0.2
· MIT-0
90
Downloads
0
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install navil-audit
Description
Deep security audit for OpenClaw. Run a comprehensive scan of all installed skills, MCP servers, and agent configuration. Generates a detailed security repor...
Usage Guidance
What to consider before installing/running Navil Audit:
- Verify the navil pip package: review the linked GitHub repo (https://github.com/navilai/navil) and confirm the PyPI package name and publisher are legitimate before pip installing.
- Run the tool in a sandbox or isolated environment first (container/VM) because pip-installed CLIs run arbitrary code and may perform network calls.
- Clarify scan targets: do not let the tool search your entire filesystem automatically. Provide explicit config paths and confirm which MCP servers and skill directories will be scanned.
- Expect that the navil CLI may query external services (VirusTotal, vulnerability feeds). If you have sensitive configs, ensure network access is controlled or redact secrets before scanning.
- Check for the metadata inconsistency: SKILL.md contains an install block while registry metadata lists no install spec—ask the publisher to reconcile this.
- For CI use, validate SARIF output handling to avoid leaking secret data into logs or external scanners.
If you want a safer evaluation, request the navil package source code (or a pinned release tarball) and have it reviewed before allowing the agent to install or run it.
Capability Assessment
Purpose & Capability
Name, description, and runtime instructions consistently describe a local security scanner and pentest toolkit (navil). Requiring pip to install a CLI scanner is reasonable and proportionate to the stated purpose.
Instruction Scope
Instructions ask the agent to 'scan all installed skills, MCP servers, and agent configuration' but do not require the user to supply explicit paths or consent; placeholders like <path-to-config> are left ambiguous. The skill delegates network queries (VirusTotal, pentest simulations) to the navil CLI without documenting network behavior or data transmission—this ambiguity could lead to sensitive config data being sent externally by the installed tool.
Install Mechanism
SKILL.md contains a pip install spec for a package named 'navil' (bins: navil), which is a common and expected install method for a Python CLI. However, the registry metadata reported 'No install spec — instruction-only', creating an inconsistency between package metadata and SKILL.md. Installing a PyPI package is higher-risk than an instruction-only skill because it executes third-party code; verify the package source (GitHub link present) before installing.
Credentials
The skill does not request any environment variables, credentials, or config paths in metadata. This is proportionate. Note: some checks (VirusTotal, remote pentest checks, MCP server scanning) may implicitly require credentials or network access at runtime; none are declared.
Persistence & Privilege
always:false and normal model invocation are used. The skill does not request persistent presence or system-wide configuration changes. It does instruct scanning of local skill configs and MCP servers, which requires file access but not elevated privilege by default.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install navil-audit - After installation, invoke the skill by name or use
/navil-audit - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.2
Fix: version sync, fix detector count
v1.0.1
Fix: license is Apache-2.0 (not MIT)
v1.0.0
Initial release — deep security audit with pen testing
Metadata
Frequently Asked Questions
What is Navil Audit?
Deep security audit for OpenClaw. Run a comprehensive scan of all installed skills, MCP servers, and agent configuration. Generates a detailed security repor... It is an AI Agent Skill for Claude Code / OpenClaw, with 90 downloads so far.
How do I install Navil Audit?
Run "/install navil-audit" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Navil Audit free?
Yes, Navil Audit is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Navil Audit support?
Navil Audit is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Navil Audit?
It is built and maintained by ivanpantheon (@ivanpantheon); the current version is v1.0.2.
More Skills