catalyst-functions

Pass

Audited by Gen Agent Trust Hub on Aug 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the catalyst command-line interface for project lifecycle management, including initialization (catalyst init), adding functions (catalyst functions:add), and deployment (catalyst deploy). These are standard operations for the platform.
  • [EXTERNAL_DOWNLOADS]: Instructions reference the installation of official vendor tools including zcatalyst-cli and zcatalyst-sdk-node from standard package registries. These are necessary dependencies for function development.
  • [PROMPT_INJECTION]: As the skill generates code for serverless functions based on user-provided descriptions, it possesses a vulnerability surface common to code-generation agents. The risk is managed through structured templates and vendor-provided SDKs.
  • [SAFE]: The skill implements security best practices by documenting the default public nature of functions and instructing developers on how to enforce authentication. It also provides detailed guidance on avoiding common security pitfalls such as duplicate CORS headers.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 15, 2026, 07:15 AM
Security Audit — agent-trust-hub — catalyst-functions