catalyst-quickml
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from external sources such as local file uploads, Zoho WorkDrive, and Zoho Learn for use in Retrieval-Augmented Generation (RAG) and machine learning pipelines.
- Ingestion points: Knowledge Base imports (SKILL.md, references/generative-ai-basics.md).
- Boundary markers: The skill does not explicitly define delimiters for separating user data from system instructions within the Knowledge Base, though it follows standard RAG patterns.
- Capability inventory: The skill utilizes SDK and REST API calls to perform predictions and generative tasks based on the ingested data.
- Sanitization: No explicit sanitization or filtering of document content is mentioned before indexing.
- [EXTERNAL_DOWNLOADS]: The skill references and fetches content from official Zoho domains (e.g., docs.catalyst.zoho.com, catalyst.zoho.com) and utilizes standard Catalyst CLI commands (catalyst login, catalyst deploy). These are verified vendor-owned resources for the 'catalystbyzoho' author and are used for documentation and legitimate project management.
Audit Metadata