package-once-red
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The 'red' launcher script downloads the tool's core logic and required libraries from the vendor's official GitHub repositories (github:getcolors/once and github:getcolors/colors-compute), which are pinned to specific, immutable commit SHAs.\n- [COMMAND_EXECUTION]: The skill instructs the user to execute the 'red' launcher script, which internally invokes environment setup commands such as 'bun install' and deployment-related operations including 'red build' and 'red create'.\n- [DYNAMIC_EXECUTION]: The launcher script dynamically resolves and imports the 'package-once-red' module from a local cache after installation, utilizing Bun's runtime resolution and dynamic import capabilities.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes deployment configurations from 'colors.yml' and environment variables (COLORS_PAR_*) to manage infrastructure. It includes specific safety guidelines, such as directing the agent not to read secret files or generated private directories, and provides validation commands to verify state before execution.
Audit Metadata