The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied application code, Dockerfiles, and app-config.json configurations to generate deployment commands and application logic. This creates a surface where instructions embedded in a codebase could influence the agent's behavior.
Ingestion points: Application source code and configuration files defined in references/appsail-basics.md are processed by the agent.
Boundary markers: The skill does not provide explicit instructions or delimiters for the agent to separate user-provided code from the agent's own instructional context.
Capability inventory: The skill uses the catalyst CLI for deployment tasks, which involves executing shell commands and accessing local project files.
Sanitization: No sanitization or validation mechanisms are mentioned for the content of the files before they are utilized in the deployment workflow.
[PRIVILEGE_ESCALATION]: The Node.js code template in references/appsail-basics.md initializes the Catalyst SDK with scope: 'admin'. While this is a documented requirement for certain administrative operations within the Catalyst ecosystem, it grants the application full administrative privileges over the project's cloud resources.
[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill documentation includes instructions for installing the zcatalyst-cli globally via npm and utilizing npm install within Docker environments. These operations involve downloading and installing external software packages, which are identified as vendor-owned tools for the Zoho Catalyst platform.

catalyst-appsail