finding-industry-event-coverage-google
Warn
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The
customMapFunctionparameter allows for the execution of arbitrary JavaScript code on the Apify platform to transform scraper output. Evidence:customMapFunctionparameter defined in the Inputs section ofSKILL.md. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Google search results and incorporates user-supplied strings into search queries. Ingestion points: Results from
google-search-scrapermentioned inSKILL.md. Capability inventory: Skill performs network operations and local script execution to process results. Boundary markers: No explicit delimiters for external content. - [COMMAND_EXECUTION]: The skill provides templates for shell commands using
nodeandcurlthat incorporate user-provided variables, necessitating careful input handling. Evidence: CLI and REST API examples inSKILL.md. - [EXTERNAL_DOWNLOADS]: The skill initiates execution of remote actors and fetches datasets from Apify's official API, representing standard integration with a well-known service.
Audit Metadata