catalyst-functions
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
catalystcommand-line interface for project lifecycle management, including initialization (catalyst init), adding functions (catalyst functions:add), and deployment (catalyst deploy). These are standard operations for the platform. - [EXTERNAL_DOWNLOADS]: Instructions reference the installation of official vendor tools including
zcatalyst-cliandzcatalyst-sdk-nodefrom standard package registries. These are necessary dependencies for function development. - [PROMPT_INJECTION]: As the skill generates code for serverless functions based on user-provided descriptions, it possesses a vulnerability surface common to code-generation agents. The risk is managed through structured templates and vendor-provided SDKs.
- [SAFE]: The skill implements security best practices by documenting the default public nature of functions and instructing developers on how to enforce authentication. It also provides detailed guidance on avoiding common security pitfalls such as duplicate CORS headers.
Audit Metadata