package-wavehouse-green
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The green launcher script fetches dependencies from the vendor's GitHub repositories (github.com/getcolors/wavehouse.git, github.com/getcolors/green.git, github.com/getcolors/once.git) at runtime. The main library is pinned to a specific commit hash for integrity control.
- [DYNAMIC_EXECUTION]: The script uses dynamic loading to execute functions from the fetched libraries via Clojure's requiring-resolve mechanism. This architectural pattern is used to implement the CLI logic while keeping the launcher script minimal.
- [DATA_EXFILTRATION]: The skill documentation provides clear instructions for handling sensitive credentials (API keys and tokens) using environment variables and gitignored files. It also implements secure storage for tokens on the provisioned server using restricted file permissions (mode 0600).
Audit Metadata