apify-trend-analysis
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions direct the user to install the
@apify/mcpcpackage, which is a well-known CLI tool for interacting with Apify services. - [COMMAND_EXECUTION]: The workflow involves running the
mcpcCLI and a local JavaScript utility (run_actor.js) to automate actor execution and data retrieval. - [INDIRECT_PROMPT_INJECTION]: The skill processes external trend data from platforms like Instagram, TikTok, and Google Trends via Apify Actors, which is a standard surface for indirect prompt injection given the skill's purpose.
- Ingestion points: Untrusted trend data enters the agent's context through the Apify dataset API in
run_actor.js(specifically in thedownloadResultsanddisplayQuickAnswerfunctions). - Boundary markers: The skill does not currently use specific delimiters or instructions to ignore potential commands embedded within the fetched social media content.
- Capability inventory: The
run_actor.jsscript includes the ability to write extracted data to the local file system usingfs.writeFileSyncand to output content to the console. - Sanitization: The script implements standard CSV formatting and string truncation for display purposes, which provides a basic layer of data handling.
Audit Metadata