building-twitter-prospect-lists
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes requests to Apify's official API (
api.apify.com) to run scrapers. This is the core functionality and uses standard, well-documented endpoints for the vendor's service. - [COMMAND_EXECUTION]: The skill provides instructions for running a local script
scripts/run_actor.jsand usingcurlto interact with the Apify API. These commands are transparent, document their purpose clearly, and are standard for developer-oriented tools. - [CREDENTIALS_UNSAFE]: The skill correctly instructs users to manage their
APIFY_TOKENvia environment variables or.envfiles, which is a recommended security best practice for secret management. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from Twitter (bios and tweets). While this is an ingestion of untrusted data, the skill uses it for structured filtering and display (Step 4 and 5) rather than directly interpolating it into executable logic or critical system prompts. The risk is minimized by the analytical nature of the workflow.
- [DYNAMIC_EXECUTION]: One input parameter,
customMapFunction, allows for a JavaScript string to be passed to the Apify actor. This execution happens within the isolated Apify environment, not on the local agent's system, which is a standard feature of the targeted platform.
Audit Metadata