package-neon-green
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The green launcher script fetches its code from the author's GitHub repositories (github.com/getcolors/neon.git, github.com/getcolors/green.git, github.com/getcolors/once.git) at runtime using Babashka dependency management. The primary library is pinned to a git commit hash.
- [DYNAMIC_EXECUTION]: The script uses dynamic dependency loading (add-deps) and symbol resolution (requiring-resolve) to load its workflow logic upon execution.
- [COMMAND_EXECUTION]: The skill executes infrastructure management tools such as OpenTofu and Ansible via the green launcher to provision cloud resources.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled configuration in colors.yml and remote status markers in R2 storage. 1. Ingestion points: colors.yml and remote markers in R2. 2. Boundary markers: The skill documents strict rules for secrets and provides a build verb for validation. 3. Capability inventory: Vultr provisioning, R2 writes, and SSH configuration. 4. Sanitization: The tool implements a validation phase that reports errors before execution.
Audit Metadata