package-signoz-blue
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The launcher script downloads library dependencies from the author's GitHub repositories (
github.com/getcolors/colors-compute.git,github.com/getcolors/signoz.git, andgithub.com/getcolors/blue.git). These references are pinned to specific git SHAs, providing supply chain integrity.- [REMOTE_CODE_EXECUTION]: The skill uses theuvtool to fetch and run remote code from vendor repositories to perform infrastructure provisioning. This is an essential part of the package functionality.- [COMMAND_EXECUTION]: Shell commands are executed viasubprocess.runto invoke theuvtool and the underlying Python packages. It also coordinates tools like Docker Compose, OpenTofu, and Ansible on the remote instance.- [CREDENTIALS_UNSAFE]: The skill manages sensitive data including Cloudflare API tokens, Vultr API keys, and R2 credentials via environment variables (COLORS_PAR_*). It also manages SSH keys and configuration in the~/.ssh/directory to enable communication with the provisioned nodes.- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided configuration fromcolors.ymland environment variables to drive infrastructure operations. - Ingestion points: Configuration values from
colors.ymland environment variables likeSIGNOZ_LIB_ROOTandCOLORS_PAR_*. - Boundary markers: Input validation and boundary enforcement are handled by the vendor library.
- Capability inventory: Subprocess execution, filesystem writes (SSH keys/configs), and network operations via cloud provider APIs.
- Sanitization: The documentation states the library validates inputs and prevents unauthorized identity changes on existing resources.- [DYNAMIC_EXECUTION]: The
bluelauncher script dynamically constructs its runtime environment usinguvand can optionally load the core library from a local filesystem path if theSIGNOZ_LIB_ROOTenvironment variable is provided.
Audit Metadata