apify-buying-signal-detection

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/aggregate.py, the runtime workflow fetches and ingests outsider-authored free text from Apify dataset items (e.g., LinkedIn post content mapped into signal_detail via map_linkedin_content_row), then conditionally enriches authors/companies and writes results to leads.csv.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The runtime scripts call the Apify REST API (APIFY_API = "https://api.apify.com/v2") to fetch datasets and to run Actors (e.g. run-sync-get-dataset-items), which executes remote Actor code the skill depends on at runtime.