The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill accepts a customMapFunction parameter described as a "JavaScript function to transform each output object," which can lead to arbitrary code execution if the underlying actor processes this string using eval() or similar mechanisms.
[COMMAND_EXECUTION]: The documentation instructs the agent to execute shell commands using node scripts/run_actor.js and curl to interact with the Apify API. While the script itself is not provided in the snippet, invoking external scripts with arguments provided in the instructions is a common vector for command injection.
[CREDENTIALS_UNSAFE]: The skill requires the APIFY_TOKEN environment variable to be set. While it follows the safe practice of using environment variables instead of hardcoding, the presence of shell commands (curl) that explicitly include the token in the URL (token=$APIFY_TOKEN) increases the risk of credential exposure in command history or logs.

finding-tiktok-ugc-creators-for-brands