package-clickstack-blue
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
bluelauncher script downloads multiple software components from thegetcolorsGitHub organization during execution.- [REMOTE_CODE_EXECUTION]: The skill executes Python code fetched from remote Git repositories. These dependencies are pinned to specific Git commit hashes (SHAs) to ensure consistency and integrity.- [COMMAND_EXECUTION]: The tool uses thesubprocessmodule to execute system commands, specifically invoking theuvtool to manage and run the provisioning logic.- [DATA_EXPOSURE]: Documentation describes the handling of sensitive materials including cloud provider API tokens, SSH private keys, and admin credentials. It guides users to store local secrets in gitignored environment files and describes how to retrieve generated credentials from the remote server via SSH.
Audit Metadata