package-n8n-green
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The launcher script
greenfetches dependencies from the vendor's GitHub infrastructure. - Evidence: The script references
https://github.com/getcolors/n8n.git,https://github.com/getcolors/green.git, andhttps://github.com/getcolors/once.gitfor library resolution. - [REMOTE_CODE_EXECUTION]: The skill downloads and executes code from GitHub at runtime.
- Evidence: The
greenscript usesbabashka.deps/add-depsto dynamically load theio.github.getcolors/n8nlibrary, which is pinned to a specific commit SHA (2979693f3371b69cc26d93d413bfcea18b0089d5) to ensure integrity. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled configuration files which influence its deployment actions.
- Ingestion points: The
colors.ymlconfiguration file andCOLORS_PAR_*environment variables. - Capability inventory: The skill provisions cloud instances on Vultr and AWS, manages firewalls, and executes Ansible playbooks.
- Boundary markers: None defined for the configuration data.
- Sanitization: Validation is performed by the
green.cliandn8nlibraries before convergence. - [COMMAND_EXECUTION]: The skill provides a CLI interface for executing deployment and maintenance workflows.
- Evidence: The
greenscript implements commands likebuild,create, anddeletewhich interact with cloud provider APIs and local tools like OpenTofu and Ansible.
Audit Metadata