package-n8n-green

Pass

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The launcher script green fetches dependencies from the vendor's GitHub infrastructure.
  • Evidence: The script references https://github.com/getcolors/n8n.git, https://github.com/getcolors/green.git, and https://github.com/getcolors/once.git for library resolution.
  • [REMOTE_CODE_EXECUTION]: The skill downloads and executes code from GitHub at runtime.
  • Evidence: The green script uses babashka.deps/add-deps to dynamically load the io.github.getcolors/n8n library, which is pinned to a specific commit SHA (2979693f3371b69cc26d93d413bfcea18b0089d5) to ensure integrity.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled configuration files which influence its deployment actions.
  • Ingestion points: The colors.yml configuration file and COLORS_PAR_* environment variables.
  • Capability inventory: The skill provisions cloud instances on Vultr and AWS, manages firewalls, and executes Ansible playbooks.
  • Boundary markers: None defined for the configuration data.
  • Sanitization: Validation is performed by the green.cli and n8n libraries before convergence.
  • [COMMAND_EXECUTION]: The skill provides a CLI interface for executing deployment and maintenance workflows.
  • Evidence: The green script implements commands like build, create, and delete which interact with cloud provider APIs and local tools like OpenTofu and Ansible.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 12, 2026, 01:45 PM