ns-autonomous

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill presents an indirect prompt injection vulnerability surface due to its data processing pipeline.
  • Ingestion points: The skill ingests untrusted data from external sources, specifically GitLab issue payloads in Engine mode and local plan files or pasted text in Standalone mode, as defined in SKILL.md and references/routing.md.
  • Boundary markers: The subagent prompt template defined in references/multi-agent-dispatch.md interpolates external, untrusted content ({unit description / acceptance criteria}) directly into instructions without strict delimiters (such as XML tags or security tokens) or instruction isolation defenses.
  • Capability inventory: The skill possesses significant capabilities, including executing local shell and git commands (git worktree add, repository preflight checks) and orchestrating subagent executions (coder-agent, ns-coder) to perform file system modifications.
  • Sanitization: Input sanitization, escaping mechanisms, or validation controls for incoming user/issue text are absent across all reference files.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 12:15 PM
Security Audit — agent-trust-hub — ns-autonomous