catalyst-setup
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill invokes the
@catalyst-cloud/catalyst-skillspackage vianpx. This is an official vendor-provided tool from coalesce-labs used for environment verification. - [COMMAND_EXECUTION]: Script files use
spawnSyncto execute the Catalyst Cloud CLI for diagnostic purposes, which is consistent with the skill's stated function. - [INDIRECT_PROMPT_INJECTION]: The skill processes readiness check data from the Catalyst Cloud CLI and tenant contracts to provide a status report.
- Ingestion points: Local CLI output is parsed as JSON in
scripts/check.mjsandscripts/replica-status.mjs. - Boundary markers: The skill does not employ explicit boundary markers or instructions to ignore embedded data in the CLI output.
- Capability inventory: The skill has command execution capabilities via the
Bashtool. - Sanitization: Standard JSON parsing is performed on the tool output without further content-specific filtering.
Audit Metadata