finding-content-gaps-from-google-serp
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill requires an
APIFY_TOKENfor authentication. The instructions correctly advise users to store this token in environment variables or a.envfile, which is the standard and safe method for credential management in development environments. - [EXTERNAL_DOWNLOADS]: The skill communicates with
api.apify.comto execute search scraping tasks. Apify is a well-known automation platform, and the skill's interaction with its official API endpoint is a legitimate and expected behavior for its primary purpose. - [COMMAND_EXECUTION]: The documentation includes examples for running a local orchestration script (
node scripts/run_actor.js). This pattern is standard for skills that require local logic to coordinate API interactions and data formatting. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external Google search results (titles and URLs). While this is a known ingestion point for potential prompt injection, the risk is mitigated as the skill processes this data for structured scoring and reporting rather than interpolating it into executable logic or sensitive agent prompts.
Audit Metadata