The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill scripts (specifically scripts/lib/cli.mjs) are configured to execute the @catalyst-cloud/catalyst-skills package using npx if a local path is not provided. This involves fetching and executing code from a public package registry at runtime. Since the @catalyst-cloud organization is not recognized as a trusted vendor in the provided configuration, this execution of unverified remote code poses a high security risk.
[CREDENTIALS_UNSAFE]: The skill is designed to interact with sensitive authentication data. The library scripts/lib/cli.mjs and scripts/lib/credential.mjs explicitly read and parse ~/.config/catalyst-cloud/customer.json, which contains personal API keys or OAuth refresh tokens used for service authentication. Direct access to and handling of local credential files by an agent skill is a high-risk pattern for data exposure.
[INDIRECT_PROMPT_INJECTION]: The skill creates a significant surface for indirect prompt injection through its reactive event loop.
Ingestion points: In scripts/watch-scope.mjs, the agent subscribes to a live stream of JSON event data (comments, tickets, PR activities) from the Catalyst Cloud CLI.
Boundary markers: The instructions in references/reacting-to-events.md lack boundary markers or warnings, directing the agent to "react to each change as it arrives" and "decide, act" within the same turn.
Capability inventory: The agent possesses write capabilities, including moving ticket states (scripts/make-ready.mjs), writing Linear comments, and executing arbitrary shell commands via the --exec flag.
Sanitization: There is no evidence of sanitization or filtering of the external event content before it is processed by the agent's logic.
[COMMAND_EXECUTION]: The runCli and execCli functions in scripts/lib/cli.mjs utilize child_process.spawn with shell: true on Windows platforms. This pattern, when combined with variables like ticket identifiers passed from agent instructions, can be vulnerable to command injection if input is not strictly validated. Furthermore, the watch-scope.mjs script exposes an --exec parameter that allows the execution of arbitrary shell commands.
[EXTERNAL_DOWNLOADS]: The skill relies on npx to fetch the core CLI tool from a remote registry at runtime, creating a dependency on external, third-party infrastructure that is not covered by a verified trust relationship.

run-this-project