package-vaultwarden-green
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
greenscript fetches Babashka libraries fromgithub.com/getcolors/vaultwarden.git,github.com/getcolors/once.git, andgithub.com/getcolors/green.gitduring the execution process. - [REMOTE_CODE_EXECUTION]: The skill uses
babashka.deps/add-depsto load the downloaded GitHub repositories into the runtime environment and executes workflow logic viarequiring-resolve. - [COMMAND_EXECUTION]: The script executes provisioning and deployment commands that interact with cloud provider APIs and local infrastructure management tools.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided configuration from
colors.ymland environment variables to define infrastructure state. 1. Ingestion points: Thecolors.ymlfile andCOLORS_PAR_*environment variables. 2. Boundary markers: Absent; the skill instructions describe these as non-secret desired state or environment-based credentials. 3. Capability inventory: The skill performs network operations, provisions cloud resources, and accesses local files such as~/.sshand~/.oci/configas documented in the configuration reference. 4. Sanitization: Absent; input validation logic is delegated to the externally loadedvaultwardenlibrary.
Audit Metadata