package-vaultwarden-green

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The green script fetches Babashka libraries from github.com/getcolors/vaultwarden.git, github.com/getcolors/once.git, and github.com/getcolors/green.git during the execution process.
  • [REMOTE_CODE_EXECUTION]: The skill uses babashka.deps/add-deps to load the downloaded GitHub repositories into the runtime environment and executes workflow logic via requiring-resolve.
  • [COMMAND_EXECUTION]: The script executes provisioning and deployment commands that interact with cloud provider APIs and local infrastructure management tools.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided configuration from colors.yml and environment variables to define infrastructure state. 1. Ingestion points: The colors.yml file and COLORS_PAR_* environment variables. 2. Boundary markers: Absent; the skill instructions describe these as non-secret desired state or environment-based credentials. 3. Capability inventory: The skill performs network operations, provisions cloud resources, and accesses local files such as ~/.ssh and ~/.oci/config as documented in the configuration reference. 4. Sanitization: Absent; input validation logic is delegated to the externally loaded vaultwarden library.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 07:43 PM