Navil Audit

Deep security audit for OpenClaw. Run a comprehensive scan of all installed skills, MCP servers, and agent configuration. Generates a detailed security repor...

What to consider before installing/running Navil Audit: - Verify the navil pip package: review the linked GitHub repo (https://github.com/navilai/navil) and confirm the PyPI package name and publisher are legitimate before pip installing. - Run the tool in a sandbox or isolated environment first (container/VM) because pip-installed CLIs run arbitrary code and may perform network calls. - Clarify scan targets: do not let the tool search your entire filesystem automatically. Provide explicit config paths and confirm which MCP servers and skill directories will be scanned. - Expect that the navil CLI may query external services (VirusTotal, vulnerability feeds). If you have sensitive configs, ensure network access is controlled or redact secrets before scanning. - Check for the metadata inconsistency: SKILL.md contains an install block while registry metadata lists no install spec—ask the publisher to reconcile this. - For CI use, validate SARIF output handling to avoid leaking secret data into logs or external scanners. If you want a safer evaluation, request the navil package source code (or a pinned release tarball) and have it reviewed before allowing the agent to install or run it.