The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes several Node.js scripts (e.g., read-ticket.mjs, search.mjs, comment.mjs) that wrap the @catalyst-cloud/catalyst-skills CLI tool. These scripts use spawnSync to invoke the CLI and pass arguments such as ticket IDs and comment bodies. This is the primary mechanism for interacting with the Catalyst Cloud tenant.\n- [EXTERNAL_DOWNLOADS]: The skill is configured to use npx @catalyst-cloud/catalyst-skills if a local path for the CLI is not specified in the configuration. This results in the download and execution of the vendor-provided CLI tool from the NPM registry. As this is an official vendor resource, it is a standard operational requirement.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources (Linear tickets) that could contain malicious instructions designed to influence the agent's behavior. \n
Ingestion points: The scripts/read-ticket.mjs and scripts/search.mjs scripts retrieve and display ticket descriptions, comments, and search results.\n
Boundary markers: No specific delimiters or safety warnings are present in the script output to distinguish between system instructions and ticket content.\n
Capability inventory: The skill possesses write capabilities including posting comments, moving tickets between states, and creating new tickets via the catalyst-skills proxy.\n
Sanitization: The scripts do not perform sanitization or filtering of the retrieved ticket data before presenting it to the agent.\n- [DYNAMIC_EXECUTION]: The skill's shared library (scripts/lib/cli.mjs) dynamically determines which CLI binary to execute by reading a local configuration file. If a cliPath is defined in the customer configuration, it executes that path directly; otherwise, it defaults to using npx.\n- [DATA_EXFILTRATION]: The skill accesses a sensitive local configuration file located at ~/.config/catalyst-cloud/customer.json. This file contains the credentials (API keys or session tokens) required for authenticating with the Catalyst Cloud service. Access is performed locally by the vendor's provided scripts to verify connectivity and locate the CLI tool.

catalyst-linear