package-temporal-green
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPRIVILEGE_ESCALATIONDYNAMIC_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The
greenlauncher script dynamically downloads and executes code from the vendor's GitHub repositories (e.g.,https://github.com/getcolors/temporal.git). It uses a pinned Git SHA to ensure the integrity of the downloaded library. - [COMMAND_EXECUTION]: The skill operates via a CLI wrapper (
green) that executes subcommands for building, creating, and deleting infrastructure resources, as well as running acceptance tests. - [CREDENTIALS_UNSAFE]: The skill requires several sensitive tokens and keys (e.g.,
COLORS_PAR_DO_TOKEN,COLORS_PAR_CLOUDFLARE_API_TOKEN) passed via environment variables. The documentation recommends storing these in a local.envrc.privatefile, which is a standard practice for secret management in development environments. - [PRIVILEGE_ESCALATION]: The
acceptanceverb may utilize passwordlesssudoon the remote target machine to perform administrative tasks such as restarting Docker or rebooting the system. - [DYNAMIC_EXECUTION]: The Babashka-based launcher utilizes
add-depsandrequiring-resolveto dynamically load and invoke functionality from its core libraries at runtime.
Audit Metadata