package-agent-network-green

Pass

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The green script fetches its library logic from the author's GitHub repositories (github.com/getcolors/*) at runtime using Babashka's dependency management.
  • [REMOTE_CODE_EXECUTION]: The skill dynamically loads and executes code from the getcolors GitHub organization. The main library dependency is pinned to a specific commit SHA (84807f...) to ensure code integrity.
  • [COMMAND_EXECUTION]: The skill is designed to run shell commands via the ./green entry point, which orchestrates infrastructure provisioning and management using OpenTofu and Ansible on Vultr or DigitalOcean compute nodes.
  • [DYNAMIC_EXECUTION]: The launcher script uses dynamic loading via babashka.deps/add-deps and requiring-resolve to bootstrap the execution environment and invoke the deployment workflow.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes a user-editable configuration file (colors.yml) and interpolates these values into infrastructure deployment commands.
  • Ingestion points: colors.yml configuration file.
  • Boundary markers: The skill documentation specifies a strict kebab-case format and provides validation logic that returns exit code 2 on failures.
  • Capability inventory: Infrastructure provisioning via OpenTofu and Ansible, SSH key management, and file system writes within the work directory.
  • Sanitization: Relies on internal validation routines within the agent-network library.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 12, 2026, 01:50 PM