The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to read sensitive credentials from the local file ~/.config/catalyst-cloud/customer.json and transmit them via a curl request to a remote endpoint. While it advises the agent not to print the key in the terminal, the credential is still exposed to the network destination specified in the configuration.
[EXTERNAL_DOWNLOADS]: The checklist includes the execution of npx @catalyst-cloud/catalyst-skills, which downloads and runs external code from the npm registry at runtime. The package is not associated with a recognized trusted organization.
[REMOTE_CODE_EXECUTION]: The use of npx to execute a package from a public registry constitutes remote code execution, as the package content is fetched and executed on the local machine during the readiness check.
[COMMAND_EXECUTION]: The skill relies on executing several shell commands, including curl for network requests, npx for package invocation, and ls for filesystem inspection.
[INDIRECT_PROMPT_INJECTION]: Vulnerability surface identified. 1. Ingestion point: ~/.config/catalyst-cloud/customer.json. 2. Boundary markers: Absent. 3. Capability inventory: Network requests via curl, package execution via npx, and file system inspection via ls. 4. Sanitization: Absent. Maliciously crafted data within the local configuration file could be used to manipulate the agent's behavior during the execution of these capabilities.

setup