apify-sdk-integration
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the official
apify-clientlibrary via standard package managers (npmandpip). These resources are provided by the vendor for interacting with their documented API. - [INDIRECT_PROMPT_INJECTION]: The skill provides the ability to ingest untrusted data from external websites via Apify Actors, which creates a vulnerability surface for indirect prompt injection if that data is subsequently processed by an AI agent without sanitization.
- Ingestion points: Untrusted data enters the application context through
client.dataset(...).listItems()andclient.keyValueStore(...).getRecord('OUTPUT')as documented inSKILL.md. - Boundary markers: The code examples do not implement delimiters or specific instructions to ignore malicious content embedded within the scraped data.
- Capability inventory: The skill uses the
apify-clientto perform network operations against Apify's API to trigger Actor runs and retrieve scraped content. - Sanitization: The provided integration snippets do not include logic for sanitizing, escaping, or validating the external content before use.
Audit Metadata