package-airflow-blue
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
bluelauncher script fetches thepackage-airflow-bluelibrary from the vendor's official GitHub repository (github.com/getcolors/airflow.git). The download is pinned to a specific commit hash, ensuring the integrity of the remote code. - [REMOTE_CODE_EXECUTION]: The launcher uses
uv runto execute logic from the downloaded package. This is the intended operation of the tool and relies on a pinned version of the vendor-supplied library. - [COMMAND_EXECUTION]: The skill orchestrates infrastructure operations using system tools including OpenTofu, Ansible, and the GitHub CLI (
gh). It performs actions such as provisioning cloud resources, configuring servers, and managing repository secrets. - [INDIRECT_PROMPT_INJECTION]: The skill defines a clear boundary for processing user-supplied configuration in
colors.yml. It includes defensive instructions for the agent to avoid hardcoding secrets and to validate configuration before execution.
Audit Metadata