how-catalyst-works

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes npx to download and execute the @catalyst-cloud/catalyst-skills package if it is not already installed locally. This package is the official tool required for the skill to function as described.
  • [COMMAND_EXECUTION]: The skill scripts execute the Catalyst Cloud CLI using node:child_process's spawnSync to query ticket status, fleet activity, and tenant configurations. The execution is scoped to the specific CLI arguments required for data retrieval.
  • [DATA_EXPOSURE]: The skill accesses a local configuration file at ~/.config/catalyst-cloud/customer.json to read authentication credentials (API keys or OAuth tokens). This access is necessary for the CLI to authenticate with the Catalyst Cloud API and is performed locally without exfiltrating the raw credentials to untrusted third parties.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 05:52 PM
Security Audit — agent-trust-hub — how-catalyst-works