package-posthog-green

Pass

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The green launcher script downloads library dependencies from the vendor's GitHub repositories, specifically posthog, green, and once (e.g., https://github.com/getcolors/posthog.git). The posthog dependency is pinned to a specific commit SHA (4eb24f94edc397b6c2424aea7d918f956599d8cc) to ensure integrity.
  • [DYNAMIC_EXECUTION]: The script utilize's Babashka's add-deps functionality to dynamically resolve and load these external git-based dependencies into the runtime environment during execution.
  • [COMMAND_EXECUTION]: The skill performs lifecycle operations by executing shell commands for SSH key management, Docker Compose operations, and local SSH configuration (~/.ssh/config) updates to enable seamless access to the target host.
  • [CREDENTIALS_UNSAFE]: The documentation defines several critical security parameters (e.g., COLORS_PAR_POSTHOG_SECRET_KEY, COLORS_PAR_POSTHOG_POSTGRES_PASSWORD, COLORS_PAR_POSTHOG_OIDC_RSA_PRIVATE_KEY) as environment variables. No hardcoded credentials were found in the skill source, following secret management best practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 12, 2026, 01:51 PM