whats-happening
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local Node.js scripts (snapshot.mjs, explain.mjs) to wrap calls to the catalyst-skills CLI. These external calls use array-based argument passing to minimize command injection risks, and execution is limited to specific vendor tools specified in the platform configuration.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external data, such as ticket titles and descriptions, fetched from the Catalyst Cloud API through its snapshot and explanation scripts. While this is the intended functionality, it creates a potential surface for indirect prompt injection.\n
- Ingestion points: Data enters the agent context via the output of CLI commands fetching issue lists and eligibility explanations in scripts/snapshot.mjs.\n
- Boundary markers: There are no explicit delimiters or instructions to ignore embedded prompts within the ingested ticket data in the provided reference prompts.\n
- Capability inventory: The skill has access to execute the catalyst-skills CLI and read local reference files.\n
- Sanitization: No specific sanitization or filtering of the fetched ticket content is performed by the local scripts before output is provided to the agent context.\n- [EXTERNAL_DOWNLOADS]: The skill utilizes npx to run the @catalyst-cloud/catalyst-skills package when a local binary is not present. This package is a vendor-provided resource necessary for the skill's primary functionality and is explicitly permitted in the skill's platform configuration.
Audit Metadata