how-catalyst-works
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
npxto download and execute the@catalyst-cloud/catalyst-skillspackage if it is not already installed locally. This package is the official tool required for the skill to function as described. - [COMMAND_EXECUTION]: The skill scripts execute the Catalyst Cloud CLI using
node:child_process'sspawnSyncto query ticket status, fleet activity, and tenant configurations. The execution is scoped to the specific CLI arguments required for data retrieval. - [DATA_EXPOSURE]: The skill accesses a local configuration file at
~/.config/catalyst-cloud/customer.jsonto read authentication credentials (API keys or OAuth tokens). This access is necessary for the CLI to authenticate with the Catalyst Cloud API and is performed locally without exfiltrating the raw credentials to untrusted third parties.
Audit Metadata