The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from local plan files, pasted text, or GitLab issue descriptions to drive its autonomous execution logic and subagent dispatch.
Ingestion points: SKILL.md (Standalone pipeline Step 1), references/routing.md (Standalone entry conditions), and the issue payload in Engine mode.
Boundary markers: The subagent prompt template in references/multi-agent-dispatch.md uses placeholders like {unit description / acceptance criteria} and {Resolved context} but lacks explicit delimiters or instructions to ignore embedded commands within that untrusted content.
Capability inventory: The skill and its subagents have the ability to write to the filesystem (via ns-coder and worktree management) and perform git operations.
Sanitization: The skill uses {version_san} for directory and branch names, suggesting sanitization of identifiers, but does not specify validation or sanitization of the natural language instructions processed during planning or dispatch.
[COMMAND_EXECUTION]: The skill performs shell-level operations for git repository management and workspace isolation.
Evidence: references/standalone-pipeline.md specifies the use of git worktree add to create isolated environments and uses pwd and git rev-parse for preflight environment validation. These operations are essential for its documented purpose of providing code isolation.

ns-autonomous