catalyst-basics
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill provides guidance for using the official Zoho Catalyst CLI and connecting to the vendor's MCP server at mcp.zoho.com, ensuring a secure and authenticated environment for project management. All external domains and resources used in the skill are verified vendor assets belonging to Zoho Catalyst.\n- [INDIRECT_PROMPT_INJECTION]: The skill establishes an automation workflow that reads local configuration files such as .catalystrc and catalyst.json to provide context for CLI commands. Ingestion points include these local configuration files, while boundary markers include instructions to verify project context via catalyst whoami and prefer MCP tools over local file reading. Capabilities include execution of CLI commands like catalyst init and catalyst deploy. While this introduces an ingestion surface for potentially untrusted local data, it is the primary intended function of the skill and is appropriately scoped within the platform's standard development workflow.\n- [EXTERNAL_DOWNLOADS]: The skill includes instructions to install the official Catalyst CLI from the NPM registry and clone reference materials from the author's official GitHub repository (catalystbyzoho), which are trusted vendor-controlled sources.
Audit Metadata