apify-sdk-integration
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFE
Full Analysis
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: Fetches official
apify-clientlibraries from standard public registries (NPM and PyPI). - [CREDENTIALS_UNSAFE]: Follows security best practices by instructing users to store API tokens in environment variables or secrets managers rather than hardcoding them.
- [DATA_EXPOSURE_AND_EXFILTRATION]: Performs legitimate network requests to official Apify API endpoints (
api.apify.com) to execute scraping and automation tasks as intended. - [INDIRECT_PROMPT_INJECTION]: The skill inherently processes data from external web sources via
apify-clientwhich serves as an indirect prompt injection surface; ingestion points are noted in the dataset item retrieval methods inSKILL.md, though no boundary markers or explicit sanitization are shown in the integration examples.
Audit Metadata