apify
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses the
APIFY_TOKENfrom the~/.claude/.envfile. This is a standard practice for managing credentials in an environment-specific configuration file. - [DATA_EXFILTRATION]: The skill executes network requests using
curltoapi.apify.com. This is the official API endpoint for the Apify service, which is the primary purpose of the skill. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external platforms including LinkedIn, Instagram, YouTube, and Google Maps.
- Ingestion points: Data is received from Apify actor runs via the Apify API.
- Boundary markers: The skill does not define specific delimiters or instructions for the agent to ignore potentially malicious content embedded in the scraped data.
- Capability inventory: The skill uses the
BashandWebFetchtools to interact with the API and log results to the local filesystem at~/.claude/logs/apify-runs.jsonl. - Sanitization: There are no explicit sanitization or filtering steps defined for the content retrieved from external platforms.
Audit Metadata