package-agent-network-green
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
greenscript fetches its library logic from the author's GitHub repositories (github.com/getcolors/*) at runtime using Babashka's dependency management. - [REMOTE_CODE_EXECUTION]: The skill dynamically loads and executes code from the
getcolorsGitHub organization. The main library dependency is pinned to a specific commit SHA (84807f...) to ensure code integrity. - [COMMAND_EXECUTION]: The skill is designed to run shell commands via the
./greenentry point, which orchestrates infrastructure provisioning and management using OpenTofu and Ansible on Vultr or DigitalOcean compute nodes. - [DYNAMIC_EXECUTION]: The launcher script uses dynamic loading via
babashka.deps/add-depsandrequiring-resolveto bootstrap the execution environment and invoke the deployment workflow. - [INDIRECT_PROMPT_INJECTION]: The skill processes a user-editable configuration file (
colors.yml) and interpolates these values into infrastructure deployment commands. - Ingestion points:
colors.ymlconfiguration file. - Boundary markers: The skill documentation specifies a strict kebab-case format and provides validation logic that returns exit code 2 on failures.
- Capability inventory: Infrastructure provisioning via OpenTofu and Ansible, SSH key management, and file system writes within the work directory.
- Sanitization: Relies on internal validation routines within the
agent-networklibrary.
Audit Metadata