package-signoz-red
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The
redlauncher script downloadspackage-signoz-redandpackage-once-redfrom the vendor's GitHub repositories and executes them to perform deployment tasks. This is the primary function of the script. - [EXTERNAL_DOWNLOADS]: The skill fetches its core logic from
github:getcolors/signozandgithub:getcolors/once. These are vendor-owned resources and are pinned to specific commit hashes (e.g.,0c03be539...) to ensure that the code has not been tampered with since the pin was set. - [COMMAND_EXECUTION]: During its first run, the
redscript usesBun.spawnSyncto execute the package manager (bun install) to resolve and install its dependencies in a localized cache directory (~/.cache/package-signoz-red). - [DYNAMIC_EXECUTION]: The script uses dynamic
import()to load the SigNoz package logic after installation, allowing for content-keyed dependency resolution.
Audit Metadata