catalyst-functions
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides templates for processing external data from HTTP request bodies, file uploads via busboy, and event arguments. This data is subsequently used in database queries (ZCQL) and file storage operations. While typical for development skills, it creates a surface where unvalidated data could influence logic if not properly sanitized by the developer.
- Ingestion points:
references/functions-advanced.md(handlingreq.bodyand multipart files),references/functions-templates.md(parsingevent.getArgument()). - Boundary markers: Not explicitly defined in the provided code snippets.
- Capability inventory: The skill utilizes SDK components for Data Store (ZCQL), Stratus (file storage), and various messaging services.
- Sanitization: No specific input validation or escaping logic is included in the templates.
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install
zcatalyst-cliandzcatalyst-sdk-nodefrom the NPM registry. These are the official command-line tools and software development kits for the Zoho Catalyst platform. - [COMMAND_EXECUTION]: The skill utilizes shell commands such as
catalyst init,catalyst functions:add, andcatalyst deployto manage project scaffolding and deployment. These are standard platform operations.
Audit Metadata