apify-ultimate-scraper
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the official Apify CLI utility (
apify-cli) from the npm registry. This is a standard prerequisite for interacting with the Apify platform. - [INDIRECT_PROMPT_INJECTION]: The skill incorporates untrusted user data—such as search queries, URLs, and JSON configurations—into shell commands executed via the Apify CLI.
- Ingestion points: User-provided inputs in
SKILL.md(Step 3: Configure and run). - Boundary markers: None. User input is typically wrapped in single quotes within shell templates.
- Capability inventory: Execution of shell commands (
apify actors call,apify actors start) that perform network operations and data retrieval. - Sanitization: No explicit sanitization or validation of user input is mentioned in the instructions.
Audit Metadata