package-github-dwh-blue
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
bluelauncher script fetches its primary logic and thepackage-github-dwh-bluepackage from the vendor's (getcolors) official GitHub repositories. These dependencies are pinned to specific Git revisions for integrity purposes.\n- [COMMAND_EXECUTION]: The skill requires the execution of the./bluePython script to perform builds, provisioning (via Vultr and Cloudflare), and data loading tasks. The script uses theuvpackage manager to manage its environment and dependencies dynamically.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-defined configuration incolors.ymlwhich influences infrastructure provisioning and SSH configuration.\n - Ingestion points: Reads project configuration from the
colors.ymlfile in the skill's root directory.\n - Boundary markers: None explicitly defined in the provided instruction set to isolate untrusted configuration data from the execution environment.\n
- Capability inventory: Performs network requests (GitHub, Vultr, Cloudflare), executes Python code, and modifies local SSH configurations (
~/.ssh/config).\n - Sanitization: Standard infrastructure-as-code patterns are used, though specific input validation for the configuration file is not detailed in the skill instructions.
Audit Metadata