ns-code-autonomous
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements a non-negotiable 'Isolation Invariant' that strictly prohibits writing application code to the main checkout or committing to base branches. It requires the use of an isolated WORK_BRANCH and WORKTREE_ROOT for all implementation tasks to ensure environment containment.
- [SAFE]: It employs a 'Doubt Resolution Protocol' to handle ambiguous or risky instructions. Destructive actions, such as data schema migrations, public API changes, or modifications to security boundaries, trigger a mandatory pause and require human intervention before proceeding.
- [SAFE]: It integrates a mandatory review loop via the ns-code-reviewer skill. Completion of a task requires an 'Approved' verdict with a score of 9/10 or higher, providing a strong automated and qualitative filter for all generated code changes.
- [SAFE]: It includes automated 'Preflight' checks that verify the current working directory and git branch immediately before any code modifications. This ensures the agent is correctly operating within its designated sandbox and prevents accidental leakage into production branches.
- [COMMAND_EXECUTION]: The skill utilizes standard git commands (e.g.,
git worktree add,git rev-parse) for repository management and environment isolation. These commands are gated by preflight checks and intended for infrastructure setup within the isolated worktree. - [PROMPT_INJECTION]: The skill ingests user-supplied plan text and local descriptor files, which constitutes a potential indirect prompt injection surface. This risk is mitigated by the skill's structural enforcement of isolation, the doubt escalation protocol, and the high-threshold review gate requirement.
Audit Metadata