package-posthog-green
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
greenlauncher script downloads library dependencies from the vendor's GitHub repositories, specificallyposthog,green, andonce(e.g.,https://github.com/getcolors/posthog.git). Theposthogdependency is pinned to a specific commit SHA (4eb24f94edc397b6c2424aea7d918f956599d8cc) to ensure integrity. - [DYNAMIC_EXECUTION]: The script utilize's Babashka's
add-depsfunctionality to dynamically resolve and load these external git-based dependencies into the runtime environment during execution. - [COMMAND_EXECUTION]: The skill performs lifecycle operations by executing shell commands for SSH key management, Docker Compose operations, and local SSH configuration (
~/.ssh/config) updates to enable seamless access to the target host. - [CREDENTIALS_UNSAFE]: The documentation defines several critical security parameters (e.g.,
COLORS_PAR_POSTHOG_SECRET_KEY,COLORS_PAR_POSTHOG_POSTGRES_PASSWORD,COLORS_PAR_POSTHOG_OIDC_RSA_PRIVATE_KEY) as environment variables. No hardcoded credentials were found in the skill source, following secret management best practices.
Audit Metadata