catalyst-functions

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill provides templates for processing external data from HTTP request bodies, file uploads via busboy, and event arguments. This data is subsequently used in database queries (ZCQL) and file storage operations. While typical for development skills, it creates a surface where unvalidated data could influence logic if not properly sanitized by the developer.
  • Ingestion points: references/functions-advanced.md (handling req.body and multipart files), references/functions-templates.md (parsing event.getArgument()).
  • Boundary markers: Not explicitly defined in the provided code snippets.
  • Capability inventory: The skill utilizes SDK components for Data Store (ZCQL), Stratus (file storage), and various messaging services.
  • Sanitization: No specific input validation or escaping logic is included in the templates.
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to install zcatalyst-cli and zcatalyst-sdk-node from the NPM registry. These are the official command-line tools and software development kits for the Zoho Catalyst platform.
  • [COMMAND_EXECUTION]: The skill utilizes shell commands such as catalyst init, catalyst functions:add, and catalyst deploy to manage project scaffolding and deployment. These are standard platform operations.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 04:09 AM