package-clickstack-green
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The launcher script fetches core deployment libraries from the vendor's official GitHub repositories (github.com/getcolors/clickstack.git, github.com/getcolors/green.git, github.com/getcolors/once.git).
- [DYNAMIC_EXECUTION]: The script utilizes Babashka's dependency resolution to dynamically load and execute Clojure code from these external repositories at runtime using a pinned commit hash for integrity.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied configuration from colors.yml. While this defines infrastructure targets, the skill implements boundary markers such as mandatory pre-execution checks, dry-run capabilities, and a fail-closed architecture to prevent unauthorized modifications.
Audit Metadata