package-temporal-green

Pass

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPRIVILEGE_ESCALATIONDYNAMIC_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The green launcher script dynamically downloads and executes code from the vendor's GitHub repositories (e.g., https://github.com/getcolors/temporal.git). It uses a pinned Git SHA to ensure the integrity of the downloaded library.
  • [COMMAND_EXECUTION]: The skill operates via a CLI wrapper (green) that executes subcommands for building, creating, and deleting infrastructure resources, as well as running acceptance tests.
  • [CREDENTIALS_UNSAFE]: The skill requires several sensitive tokens and keys (e.g., COLORS_PAR_DO_TOKEN, COLORS_PAR_CLOUDFLARE_API_TOKEN) passed via environment variables. The documentation recommends storing these in a local .envrc.private file, which is a standard practice for secret management in development environments.
  • [PRIVILEGE_ESCALATION]: The acceptance verb may utilize passwordless sudo on the remote target machine to perform administrative tasks such as restarting Docker or rebooting the system.
  • [DYNAMIC_EXECUTION]: The Babashka-based launcher utilizes add-deps and requiring-resolve to dynamically load and invoke functionality from its core libraries at runtime.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 12, 2026, 01:47 PM