Agent skill · security · jeremylongshore
navan-security-basics
Threat-model a Navan integration across identity, travel, expense, payment, file, and downstream systems. Use when performing design or security review. Trigger with "secure Navan integration", "Navan threat model", or "review Navan data flow".
Why this skill is useful
Adds executable scripts for OAuth 2.0 credential management and rotation specific to Navan's API that are not publicly documented.
What it needs
Requires node, python installed locally. Requires navan account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Navan Integration Security Boundary Overview Threat-model a Navan integration across identity, travel, expense, payment, file, and downstream systems. This workflow produces an auditable decision or artifact before any live action. Prerequisites Access to the selected tenant's current Navan Help Center and contracted integration documentation. A named business owner and data owner for the travel or expense workflow. A non-production evidence set with secrets and traveler data removed. Current Contract Navan states that its APIs undergo security testing and that data in transit and sensitive data at rest are encrypted. Those vendor controls do not replace customer-side least privilege, downstream encryption, retention, monitoring, or third-party AI governance. Authentication Use dedicated integration identities, scoped access, approved secret storage, host binding, rotation, and revocation. Keep interactive admin and automation credentials separate. Instructions 1. Draw trust boundaries from Navan through every processor and destination. 2. Classify credentials and traveler, itinerary, payment, receipt, profile, and location data. 3. Minimize fields, purposes, destinations, retention, and human access. 4. Model credential theft, tenant mix-up, injection, replay, exfiltration, and confused-deputy paths. 5. Add deny-by-default network, logging, artifact, and AI-tool policies. 6. Test detection, containment, revocation, reconciliation, and notification paths. Tool Discipline Use Read, Glob, and Grep to inspect documentation, schemas, configuration, code, fixtures, and evidence. Use Write and Edit only for approved repository artifacts. Invocation alone does not authorize network access, credentials, traveler or expense data, bookings, payments, policy or identity changes, file transfers, deployments, or deletion. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/navan-security-basics--92e079