package-doks-blue
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches its core logic and dependencies from the vendor's official GitHub repositories (
github.com/getcolors/doks.git,github.com/getcolors/blue.git, andgithub.com/getcolors/colors-compute.git) using specific git revisions (SHAs). - [COMMAND_EXECUTION]: The
bluelauncher script usessubprocess.runto execute the main application viauv. It includes a feature to override the library path using theDOKS_LIB_ROOTenvironment variable, which is a standard development override mechanism. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied configuration files (
colors.yml) and environment variables (COLORS_PAR_*) to drive infrastructure changes. - Ingestion points:
colors.ymlconfiguration file and system environment variables. - Boundary markers: Not applicable to this CLI-driven tool.
- Capability inventory: The skill performs cloud API network requests, shell command execution via
subprocess, and writes sensitive local files such askubeconfigand registry credentials. - Sanitization: Validation is performed by the underlying
package-doks-bluelibrary as described in the documentation.
Audit Metadata