The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes the @catalyst-cloud/catalyst-skills package, which is managed via npx. This is the primary tool for the skill's functionality and is explicitly allowed in the skill's environment configuration. The skill also references a specific version (0.7.0) in its internal metadata.
[COMMAND_EXECUTION]: The skill executes local commands using the catalyst-skills CLI to retrieve system status, verify credentials, and manage environment variables. These operations are performed through node scripts (where-am-i.mjs, lib/cli.mjs) that use spawnSync. Access to the local file system is restricted to standard configuration paths (e.g., ~/.config/catalyst-cloud/customer.json) required for the CLI's operation.
[INDIRECT_PROMPT_INJECTION]: The skill processes output from external CLI tools, which constitutes an indirect prompt injection attack surface.
Ingestion points: Untrusted data enters the agent context via the stdout of commands like status, ready, me, and contract executed in scripts/where-am-i.mjs.
Boundary markers: The instructions lack explicit delimiters or instructions for the agent to ignore potentially malicious instructions embedded in the tool outputs.
Capability inventory: The skill can execute shell commands (restricted to the catalyst-skills CLI) and perform local file reads for configuration.
Sanitization: The skill scripts parse command output as JSON or split it by lines but do not implement specific security sanitization or escaping for the LLM context.

catalyst-onboard