package-clickhouse-green
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The
greenscript fetches theclickhouselibrary as an external dependency from the official GitHub repositoryhttps://github.com/getcolors/clickhouse.gitat a pinned commit hash for integrity. - [DYNAMIC_EXECUTION]: The launcher employs dynamic loading mechanisms to resolve and execute CLI and workflow logic from resolved libraries at runtime.
- [COMMAND_EXECUTION]: The script manages infrastructure operations including provisioning servers, configuring networks, and running data tests using local tools like
uvandssh. - [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific configuration and environment variables to drive the provisioning process. Evidence: 1. Ingestion points: colors.yml and COLORS_PAR_* environment variables. 2. Boundary markers: No explicit boundary markers found in the launcher. 3. Capability inventory: Infrastructure provisioning (ClickHouse, Cloudflare, Metabase) and shell execution via the green tool. 4. Sanitization: Handled by the underlying clickhouse library logic.
Audit Metadata