ns-autonomous
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill presents an indirect prompt injection vulnerability surface due to its data processing pipeline.
- Ingestion points: The skill ingests untrusted data from external sources, specifically GitLab issue payloads in Engine mode and local plan files or pasted text in Standalone mode, as defined in
SKILL.mdandreferences/routing.md. - Boundary markers: The subagent prompt template defined in
references/multi-agent-dispatch.mdinterpolates external, untrusted content ({unit description / acceptance criteria}) directly into instructions without strict delimiters (such as XML tags or security tokens) or instruction isolation defenses. - Capability inventory: The skill possesses significant capabilities, including executing local shell and git commands (
git worktree add, repository preflight checks) and orchestrating subagent executions (coder-agent,ns-coder) to perform file system modifications. - Sanitization: Input sanitization, escaping mechanisms, or validation controls for incoming user/issue text are absent across all reference files.
Audit Metadata